Nginx returns different SSL certificates for one domain

Allmektiger

8/15/24, 1:29 PM

Problem summary:

one nginx server
one domain with SSL certificate
when accessing the site from one network, nginx returns the correct current certificate (1), and when accessing from other networks - some other one (2), expired a couple of years ago
The old certificate (2) is missing from the server, it's not in any nginx configuration

I even tried using the grep like "grep -r 'row_from_bad_cert' /". For comparison, in the same way the actual current certificate (1) is found successfully, but old one (2) - none.

The server is configured 100% correctly. Problems that there could be other nginx configurations for this domain in which the certificate (2) is used are completely excluded.

At the same time, there are requests in the nginx access log in which the server issued a certificate (2).

In addition to the browser, I used utilities such as

openssl s_client -connect domain:443 -prexit -debug
nmap -p 443 --script ssl-cert domain

From one network, these commands return information about the current certificate (1), from another network - about the old one (2).

nmap shown correct server IP both times, but different certificates.

The site absolutely does not use technologies such as clusters, round robin dns etc. The server is the only one. DNS points to it by a single A-record.

I restart server and nginx couple of times, of course. The certificate was replaced a long time ago (the old certificate (2) was for 2021-2022).

I've set up dozens of servers, but this is the first time I've come across this situation. I have already broken my head and exhausted all guesses.

Please, help me, maybe there are some other commands that can be used to debug a certificate request to make sure that it is exactly requested from the right server, and which certificate nginx gives when requested (i mean from server side).

Sorry, but i can't tell actual domain due to security reason.

1 + 0

ssl

nginx

https

Score:0

Server

AndyM

8/15/24, 1:53 PM

Seems very confusing. Difficult to diagnose without configs etc. I would break down your debugging into steps.

Stop Nginx. Try from both networks. If your site is still responding you have a problem.
Temporally remove/comment out the Nginx config for the working correct cert. Replace with a default "Welcome to". Try the site from both networks. If you are still getting the old cert when using certain networks you have some old config being referenced somewhere and you need to hunt it down. If your old cert goes away then the old cert is still somehow linked to your new config
Run Nginx with higher level debugging. This may point you in the right direction

+ 1

Allmektiger

8/15/24, 3:02 PM

Great thanks! You are my lifesaver. Stopping nginx helps. When accessed from some networks, the request was intercepted by an undefined proxy, from others access was direct.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Nginx returns different SSL certificates for one domain

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.