What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Yes, Nginx can serve different SSL certificates for multiple HTTPS domains from one IP address. The standard solution is TLS Server Name Indication (SNI): create one server block per hostname, make every block listen on port 443, assign the correct server_name, and point each block to that hostname’s certificate and private key. During the TLS handshake, the client sends the requested hostname in SNI, allowing Nginx to select the matching certificate before HTTP begins.
The configuration is reliable when the client sends SNI, the names in server_name match the certificate’s Subject Alternative Name entries, and Nginx has permission to read the certificate files. A client that sends no SNI, connects by literal IP address, or reaches a different server can receive the default certificate instead.
How multiple certificates work on one IP
HTTPS starts with a TLS handshake, before the browser sends an HTTP request. A client that supports SNI includes the hostname it wants, such as www.example.com, in that handshake. Nginx uses the hostname to choose the appropriate virtual server and presents that server’s certificate. After TLS negotiation, Nginx can make a second selection using the HTTP request and its Host header.
Each virtual server shares the same local address and port, but has its own hostname, document root, certificate, and private key. The IP address therefore does not identify a certificate by itself; the SNI hostname does.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Nginx initially creates the connection in the default-server context for the address and port. If the client supplies SNI, Nginx can switch to the matching server during the handshake. If SNI is absent, the name is unknown, or the client connects to an IP literal, Nginx falls back to the default certificate. This is the usual explanation for seeing the first site’s certificate when testing a second domain.
Prerequisites before changing Nginx
Confirm SNI-capable Nginx and OpenSSL
Check the compiled Nginx features with:
nginx -VLook for the SNI support indication described by Nginx. The runtime OpenSSL library must also support the TLS extension. A dynamically linked Nginx can be built with SNI support but run with a library that lacks the required capability, which effectively prevents SNI selection.
Free tools Windows power users keep installed
One-click scans. No signup required.
Point every hostname to the same endpoint
Create DNS records for every hostname and ensure they resolve to the IP address where this Nginx instance listens. Test both IPv4 and IPv6 records if you publish both; a correct certificate on one address does not help a client that reaches another address.
Prepare a certificate and key for each name
For separate certificates, verify that every certificate’s Subject Alternative Name (SAN) contains the exact hostname used in server_name. A certificate for example.com does not automatically cover www.example.com, and the reverse is also true unless both names are listed.
Keep a predictable directory layout so paths in the configuration cannot be confused:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
/etc/nginx/tls/www.example.com/fullchain.pem
/etc/nginx/tls/www.example.com/privkey.pem
/etc/nginx/tls/www.example.org/fullchain.pem
/etc/nginx/tls/www.example.org/privkey.pemThe PEM used by ssl_certificate should contain the leaf certificate first, followed by the intermediate certificates that complete the chain. Do not place the private key in that PEM. Restrict the key so ordinary users cannot read it, while allowing the Nginx master process to access it. The exact owner and group depend on how Nginx starts on your operating system.
Configure one HTTPS server block per hostname
Minimal two-domain configuration
Place the following inside the Nginx http context, either directly in the main configuration or in a file included from it:
http {
server {
listen 443 ssl;
server_name www.example.com;
ssl_certificate /etc/nginx/tls/www.example.com/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/www.example.com/privkey.pem;
root /srv/www/example-com;
}
server {
listen 443 ssl;
server_name www.example.org;
ssl_certificate /etc/nginx/tls/www.example.org/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/www.example.org/privkey.pem;
root /srv/www/example-org;
}
}The two blocks deliberately use the same listen 443 ssl; endpoint. Nginx distinguishes them by server_name and the SNI value supplied by the client. Add each additional hostname as another server block, with its own certificate and key.
Covering apex and www names
If visitors use both example.com and www.example.com, decide whether one block should serve both names or whether one should redirect to the other. A single certificate must contain both names in its SAN set when one block serves both:
server_name example.com www.example.com;If the names use different certificates or different applications, create separate blocks and ensure each certificate covers only the names assigned to that block.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Choosing the default server
Explicitly mark the block you want to answer unmatched connections:
listen 443 ssl default_server;Use this block for a deliberate fallback, such as a generic error response. Without an explicit default, Nginx uses the first server declared for that address and port. The default certificate is what non-SNI clients and IP-literal tests normally see, so choose it intentionally rather than relying on file order.
Optional HTTP-to-HTTPS redirect
Port 80 does not use a certificate. You can redirect clear-text requests to the canonical HTTPS hostname with a separate block:
server {
listen 80;
server_name www.example.com;
return 301 https://www.example.com$request_uri;
}Repeat or adapt the redirect for each public hostname. Keep the TLS blocks on port 443; a port-80 redirect cannot solve a certificate-selection problem on port 443.
Validate the configuration and reload safely
- Check syntax and file access before disrupting running connections:
sudo nginx -tThe test must report successful syntax and configuration checks. Errors commonly identify a misspelled path, unreadable key, duplicate directive, or malformed PEM file.
- Reload Nginx through the service manager used by your operating system. On a systemd host, the typical command is:
sudo systemctl reload nginxOther init systems use different commands; use that platform’s Nginx service action.
- Confirm that the new worker processes are serving traffic and that the old certificate is no longer being presented. A reload applies configuration without intentionally dropping existing connections.
Never skip nginx -t. A reload that fails validation leaves the previous working configuration in place, while correcting the error and repeating the test gives you a controlled recovery path.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Test each certificate with SNI explicitly
Test by hostname, not only by IP address. The following command connects to the address while sending an SNI value for the first site:
openssl s_client -connect 203.0.113.10:443 -servername www.example.comInspect the certificate subject and SAN values in the output. Then repeat with the second hostname:
openssl s_client -connect 203.0.113.10:443 -servername www.example.orgBoth commands can use the same IP while receiving different certificates. A test such as openssl s_client -connect 203.0.113.10:443 omits -servername and intentionally exercises the default-server behavior; it is not a valid test of the second virtual host.
If a hostname test still returns the wrong certificate, verify that the IP in the command is the address returned by DNS, that the connection reaches this Nginx instance, and that the reload completed successfully.
Diagnose a wrong certificate for the second domain
| Symptom | Likely cause | What to check or fix |
|---|---|---|
| The first site’s certificate appears when testing by IP | No hostname was sent, so Nginx used the default server. | Test with -servername www.example.org. Select an intentional default_server for unmatched traffic. |
| A browser reports a name mismatch for one domain | The certificate SAN does not contain the exact requested name. | Inspect the SAN set and issue or assign a certificate that includes the hostname. Check apex and www separately. |
| Both domains always return one certificate | The blocks do not share the same listen 443 ssl endpoint, the server_name is misspelled, or the new file was not loaded. |
Compare the listen address, spelling, included files, nginx -t output, and reload status. |
| Changes are correct on disk but the old certificate remains | Nginx was not reloaded, or the test reaches another IP or server. | Reload after a successful syntax test, resolve the hostname, and compare the destination IP with the Nginx host. |
| Nginx refuses to start or reload | A certificate or key path is wrong, the PEM is malformed, or the master process cannot read the key. | Correct the path and permissions, verify the chain file, and rerun nginx -t. |
| Only an old client receives the default certificate | The client does not send SNI, or its TLS library lacks support. | Use a separate IP address for that server if compatibility with non-SNI clients is required. |
| Two blocks appear to match the same hostname | The same name is declared in multiple servers on the same address and port. | Remove the duplicate or assign distinct names. Nginx’s selection can otherwise depend on the first matching declaration. |
Check the certificate chain
A hostname can be correct while clients still reject the connection if the server sends only the leaf certificate. Put the primary certificate first in fullchain.pem, then the intermediate certificates. The private key belongs in the separate file named by ssl_certificate_key.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Check address families and proxies
If a domain has an AAAA record, some clients will use IPv6 and may reach a different Nginx configuration. Test the IPv4 and IPv6 destinations independently. Likewise, a load balancer or reverse proxy in front of Nginx may terminate TLS and present its own certificate; changing the backend Nginx block cannot change a certificate selected by an upstream TLS terminator.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Alternatives to separate SNI certificates
SNI is the normal choice, but the right design depends on client compatibility, naming patterns, certificate-management effort, and whether extra addresses are available.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →| Approach | Best fit | Important limits | Operational trade-off |
|---|---|---|---|
| Separate certificate per server block with SNI | Unrelated domains or applications sharing one modern HTTPS endpoint | Clients must send SNI; each name must match its certificate SAN | Independent renewal and private-key handling for every site |
| One SAN certificate | A controlled set of exact names managed together | The SAN field has finite size; adding or removing one name requires replacing the certificate | One certificate and key to deploy, but all names share its renewal lifecycle |
| Wildcard certificate | Many subdomains at one level, such as app.example.org and mail.example.org |
*.example.org does not cover the apex example.org or a deeper name such as www.sub.example.org |
Fewer certificates, but a widely shared wildcard private key has a larger compromise impact |
| Separate IP address per HTTPS server | Non-SNI clients or strict isolation requirements | Requires additional addresses and separate listener configuration | Most compatible fallback, with greater address and network-management overhead |
Nginx describes SNI as a generic way to run several HTTPS servers on one IP address. Separate addresses remain the robust fallback when a client cannot send SNI. A SAN or wildcard certificate changes certificate coverage, not the underlying need to route requests to the correct application.
Advanced certificate configuration
Sharing one certificate at http scope
If several servers intentionally use the same certificate and key, define the certificate directives once at http scope so child servers inherit them:
http {
ssl_certificate /etc/nginx/tls/shared/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/shared/privkey.pem;
server {
listen 443 ssl;
server_name app.example.com;
root /srv/www/app;
}
server {
listen 443 ssl;
server_name admin.example.com;
root /srv/www/admin;
}
}This can let Nginx keep one memory copy of the shared certificate and key instead of repeating identical directives in every server. Do not use this pattern when the servers need different certificates.
Serving RSA and ECDSA certificate types
Current Nginx can repeat ssl_certificate and ssl_certificate_key for different certificate types, such as RSA and ECDSA, when the linked OpenSSL capabilities support them. Keep each certificate paired with its corresponding private key and verify the resulting configuration with nginx -t. Client capabilities determine which suitable type is negotiated; this feature does not remove the need for correct SNI names.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Version considerations
| Nginx version milestone | Documented capability |
|---|---|
| 0.5.23 | SNI support is documented as present. |
| 0.7.14 | The ssl parameter on the listen directive is documented as available. |
| 1.15.9 | Variable certificate filenames are documented as supported. |
| 1.27.4 | Certificate caching is documented as available. |
These are feature milestones, not performance measurements. Check the actual Nginx and OpenSSL versions on the host before relying on a newer directive or behavior.
Renewal and maintenance checklist
- Keep each hostname’s certificate, chain, and private key in a clearly named directory.
- Confirm every SAN entry still matches the names declared in the corresponding
server_name. - Replace the full chain and key together when a certificate is renewed, then run
nginx -t. - Reload Nginx only after validation succeeds.
- Use an SNI-aware test for every hostname after a renewal, not just a test against the IP address.
- Check file permissions after automated renewal so the Nginx master process can read the key without exposing it to unrelated users.
- Review the intentional default certificate and response for unknown names.
- Recheck IPv4 and IPv6 endpoints when DNS records or hosting topology changes.
What to remember
Multiple SSL certificates on one IP work because SNI lets Nginx choose a virtual server during the TLS handshake. Give every HTTPS hostname its own matching server_name, certificate, and private key, keep the complete chain in the certificate PEM, validate with nginx -t, reload through the host service manager, and test with openssl s_client while supplying -servername. If clients without SNI must be supported, use separate IP addresses; SAN and wildcard certificates are alternatives with explicit naming and size limits.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
