Server Name Indication (SNI) lets a single IP address serve multiple HTTPS domains, each with its own distinct SSL certificate — the standard modern approach for hosting multiple secure sites on one VPS.
What SNI Solves
Historically, one IP address could only serve one SSL certificate; SNI (now universally supported by modern browsers) lets the client indicate which domain it's requesting during the TLS handshake itself, allowing the server to select and present the correct certificate for that specific domain.
Basic Multi-Domain Configuration
server {
listen 443 ssl;
server_name site1.com;
ssl_certificate /etc/letsencrypt/live/site1.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/site1.com/privkey.pem;
root /var/www/site1;
}
server {
listen 443 ssl;
server_name site2.com;
ssl_certificate /etc/letsencrypt/live/site2.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/site2.com/privkey.pem;
root /var/www/site2;
}Each server block defines its own certificate; Nginx automatically presents the correct one based on the SNI hostname the client requested.
Obtaining Certificates for Multiple Independent Domains
sudo certbot --nginx -d site1.com
sudo certbot --nginx -d site2.comRun Certbot separately for each distinct domain (unlike subdomains of the same base domain, which can often share one certificate with SANs).
Verifying SNI Is Working Correctly
echo | openssl s_client -connect YOUR_SERVER_IP:443 -servername site1.com 2>/dev/null | openssl x509 -noout -subject
echo | openssl s_client -connect YOUR_SERVER_IP:443 -servername site2.com 2>/dev/null | openssl x509 -noout -subjectEach command should return the certificate specific to the requested domain, confirming SNI-based certificate selection is functioning correctly.
Setting a Default Server for Requests Without SNI
server {
listen 443 ssl default_server;
server_name _;
ssl_certificate /etc/ssl/certs/default.crt;
ssl_certificate_key /etc/ssl/private/default.key;
return 444;
}Handles rare legacy clients or malformed requests that don't properly specify SNI — return 444 closes the connection without a response, a common approach for such edge-case traffic.
Managing Renewal for Many Domains
sudo certbot renewCertbot automatically handles renewal for all previously-issued certificates on the server in one command, regardless of how many separate domains are configured.
SNI and Older Clients
Extremely old clients (some very outdated mobile browsers, ancient software) may lack SNI support — a negligible concern for the vast majority of current web traffic, but worth being aware of if you have specific knowledge of legacy client requirements.
Organizing Configuration for Many Domains
include /etc/nginx/sites-enabled/*;Keep each domain's server block in its own file under sites-available/sites-enabled for easier management as the number of hosted domains grows.
Common Errors
Wrong certificate served for a specific domain — verify the server_name directive in each block exactly matches the intended domain, and that there's no earlier, overly-broad server block accidentally catching the request first.
Continue Reading
- Nginx Virtual Hosts (Server Blocks): Hosting Multiple Websites on One VPS
- How to Install a Wildcard SSL Certificate with Certbot DNS Challenge
- How to Handle SSL Certificates in a Load-Balanced Environment
Browse more articles in Web Servers.
