nginx多个二级域名使用统一证书?

Question

前提

1. 我有一个包含泛域名( *.example.com 和 example.com )的证书;
2. 我的目的nginx,所有example.com一级、二级域名都用这一个证书;

实现方式

方式一：验证通过, 但冗余代码太多

每个匹配的域名 都加载证书, 个人感觉太累赘了,因为证书都是同一个

# example.com
server {
    listen 443;
    server_name example.com;
    ssl on;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    location / {
        ...
    }
}
# aaa.example.com
server {
    listen 443;
    server_name aaa.example.com;
    ssl on;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    location / {
        ...
    }
}
# bbb.example.com
server {
    listen 443;
    server_name bbb.example.com;
    ssl on;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    location / {
        ...
    }
}

方式二：有问题 !!!

我想要把方式一中所有证书走统一路径,如何实现?

# 所有 符合 server_name 都加载些证书
server {
    listen 443;
    server_name *.example.com example.com;
    ssl on;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
}

# example.com
server {
    listen 443;
    server_name example.com;
    location / {
        ...
    }
}
# aaa.example.com
server {
    listen 443;
    server_name aaa.example.com;
    location / {
        ...
    }
}
# bbb.example.com
server {
    listen 443;
    server_name bbb.example.com;
    location / {
        ...
    }
}

问题

如何不累赘(所有证书走统一路径)实现证书加载?

Answer 1

nginx 支持 include 的啊

# ssl_certificate.conf，只写 证书相关的部分
ssl on;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

# 所有 符合 server_name 都加载些证书
server {
    listen 443;
    server_name *.example.com example.com;
    
    include ssl_certificate.conf;
}

# example.com
server {
    listen 443;
    server_name example.com;

    include ssl_certificate.conf;

    location / {
        ...
    }
}

Answer 2

知道了,谢谢哈
问你另外一个问题,nginx有没有类似总开关的东西,
就是这样

入口把控 {
    # 在所有 server (请求) 开始之前处理
}
server {
    # server 1 ...
}
server {
    # server 2 ...
}
...
出口把控 {
    # 在所有 server (请求) 完成之后处理
}

不知道有没有?