Two domains on one droplet with one SSL certificate

It seems the problem has been solved now with the above configuration. I had to remove the first domain from the sites-enabled first though. After that the second domain worked. When I re-added the first domain to the sites-enabled, they both worked properly.

These are the only 2 configuration files, I have removed the default file from the sites-enabled. Domain 1 as following:

#domain1

server {
        listen 80 default_server;
        server_name www.domain1.com domain1.com;
        return 301 https://$server_name$request_uri;
}

server {
        server_name www.domain1.com domain1.com;
        listen 443 ssl http2;

        ssl_certificate /etc/letsencrypt/live/www.domain1.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/www.domain1.com/privkey.pem;
        include /etc/nginx/snippets/ssl-params.conf;

    location / {
        proxy_pass http://localhost:3001;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
     }
     location ~ /.well-known {
             allow all;
    }
}

And domain2:

#domain2
server {
    listen 80;
    server_name domain2.com www.domain2.com;
    return 301 https://$server_name$request_uri;
}

server {
  listen 443 ssl http2;
  server_name domain2.com www.domain2.com;

  root /home/Bas/domain2;
  index index.html index.htm;

  ssl_certificate /etc/letsencrypt/live/domain2.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/domain2.com/privkey.pem;

  include /etc/nginx/snippets/ssl-params.conf;

  location / {
         try_files $uri $uri/ =404;
         }
}

@basmariot

What’s inside of /etc/nginx/snippets/ssl-params.conf?

…

As far as the server blocks go, let’s start with the two that listen on Port 80.

When you’re proxying requests, you don’t need the same directives that you would need if you were not. We can shrink down the first two server blocks.

domain1.com

This:

server {
        listen 80 default_server;

        root /home/Bas/domain1;
        index index.html index.htm;

        server_name www.domain1.com domain1.com;
        return 301 https://$server_name$request_uri;
}

Becomes:

server {
    listen 80;
    server_name www.domain1.com domain1.com;
    
    return 301 https://$server_name$request_uri;
}

domain2.com

The second domain is already using the shrunken down version, so no changes are needed.

…

Now let’s focus on the server blocks listening on Port 443 (SSL). Your first domain looks ok in terms of basic setup, though domain2.com is where the issue is.

domain2.com

This is where the issue is:

  location / {
         try_files $uri $uri/ =404;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-NginX-Proxy true;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_pass http://localhost:80/;
         proxy_ssl_session_reuse off;
         proxy_set_header Host $http_host
         proxy_cache_bypass $http_upgrade;
         proxy_redirect off; 
 }

1). When proxying, don’t use try_files, so the first step is removing that line.

2). When proxying, you can’t proxy to Port 80 and have a redirect that redirects 80 back to 443, this is what’s causing the endless loop.

So the above should look like:

location / {
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-NginX-Proxy true;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass http://localhost:80/;
    proxy_ssl_session_reuse off;
    proxy_set_header Host $http_host
    proxy_cache_bypass $http_upgrade;
    proxy_redirect off; 
}

But you need to change proxy_pass http://localhost:80/; and change 80 to the port of your app.

Okay so the issue is the port set in proxy pass (for the second domain). You do a 301 redirect from normal http server to https server, and in https server you proxy_pass back to localhost:80 on standard http. This creates a redirect unending loop.

Https support for static websites does not need or work with proxy_pass, to fix this remove it. You do not need a location / { } block for a static website, just set a root folder and an index file and it should work and keep the .well-known location block, you will need that for Let’s Encrypt.

Also to #domain1 you may want to add $request_uri to the end

proxy_pass http://localhost:3001?$request_uri;

Hope this helps.