highAdvancedSymptom-first#sni#proxy#tls#certificate#vhost

Proxy SNI mismatch -- TLS SNI not forwarded, every vhost gets the default certificate

Browser shows certificate warning for a vhost -- certificate CN doesn't match the hostname

Likely source:configurationsecurity

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Browser shows certificate warning for a vhost -- certificate CN doesn't match the hostname
  • openssl s_client shows the default/catch-all certificate instead of the vhost-specific one
  • All virtual hosts behind the proxy serve the same (wrong) certificate

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Certificate served for the target hostname

    openssl s_client -connect <PROXY>:<PORT> -servername <HOST> 2>/dev/null | openssl x509 -noout -subject

  • Default certificate on the proxy

    openssl s_client -connect <PROXY>:<PORT> -noservername 2>/dev/null | openssl x509 -noout -subject

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • All vhosts serve the same default certificate
  • proxy_ssl_server_name is missing from the nginx config

Confirm before fixing

grep proxy_ssl_server_name /etc/nginx/conf.d/*.conf
READ

Search for the SNI forwarding directive

Fix

echo 'Add proxy_ssl_server_name on; and proxy_ssl_name <hostname>; to the proxy_pass location block.'
READ

Document the nginx SNI forwarding fix

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
openssl s_client -connect <PROXY>:<PORT> -servername <HOST> 2>/dev/null | openssl x509 -noout -subject
READ

Test with SNI set to the hostname

2
openssl s_client -connect <PROXY>:<PORT> -noservername 2>/dev/null | openssl x509 -noout -subject
READ

Test without SNI to compare

3
grep -r 'proxy_ssl_server_name' /etc/nginx/conf.d/
READ

Check if SNI forwarding is enabled

Prevention

  • Always enable proxy_ssl_server_name when proxying TLS connections through nginx.
  • Test SNI forwarding with openssl s_client before deploying vhost changes.
  • Document the expected certificate per vhost in the nginx configuration.
  • Use automated certificate monitoring to detect when the wrong cert is served.

Related runbooks

Same stack, same failure family — worth a skim.

TLS hostname mismatch — certificate doesn't cover the namehigh

'SSL: certificate subject does not match hostname' in clients

TLS & PKIFoundation2 causes
Open runbook
TLS certificate chain incomplete — intermediate missingmedium

openssl s_client shows 'unable to get local issuer certificate'

TLS & PKIIntermediate2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.