Multidomain in one server block

[4external]

Hi!

I am not a big expert in NGINX and ACME, and I do not fully understand the purpose of njs-acme.

I am making a service that works with several domains. Having listed them in
js_var $njs_acme_server_names 'supserv.io servsup.cc bigserv.link';

I am faced with the fact that when accessing second domain (servsup.cc) I receive a certificate from first domain in var - supserv.io

and looking in the code - it is really return first domain

function acmeCommonName(r) {
  // The first name is the common name
  return acmeServerNames(r)[0];
}

Before this, my nginx configuration was like this

    map $ssl_server_name $domain {
        default $ssl_server_name;
        ~(([^\.]+)\.([^\.]+))$ $1;
    }

    server {
        server_name _;

        listen 443 ssl default_server;

        # ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem; 
        # ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem; 

So my question is - is it possible to achieve with njs-acme that having one server block in config the acme-njs gives the required certificate?

[zsteinkamp]

Hi @4external -- Are you receiving a certificate error in your web browser?

When you specify multiple hostnames for $njs_acme_server_names, the first hostname is used as the certificate Common Name, but the others are registered as Subject Alternative Name (SAN) values, which are honored by web browsers as additional valid hostnames for the certificate. https://www.digicert.com/faq/public-trust-and-certificates/what-is-a-multi-domain-san-certificate

My own sites use this configuration -- I have six domains under a single certificate. You can see the environment variable definitions for njs-acme config here: https://github.com/zsteinkamp/web-proxy/blob/main/docker-compose.yml. (I used environment variables, but nginx variables are functionally equivalent). Feel free to load any of the hostnames mentioned in your browser and inspect the certificate.

Happy to help troubleshoot your setup with some more information about errors you are seeing, or perhaps you were expecting to get different certificates for each hostname, which will not be the case with njs-acme.