2

I have a Debian server running Nginx under a domain, and I have 2 different SSL certificates, from different authorities. Is it possible to configure Nginx in a way to serve one SSL certificate, but then to serve another one as a fallback if the first one is expired, or the client doesn't accept it?

I've looked into SNI, but it appears it's only for servers that have multiple domains, with separate certificates.

Improve this question

1 Answer 1

Reset to default
3

The server has no knowledge if the client will accept a certificate or not because validation is fully done at the client and depends a lot on the clients trust anchors. The server also has no knowledge if the client just reconnected because it failed to accept the previously sent certificate. This means the server can not pick another certificate just because the client did not accept the last one.
Apart from that clients will not just reconnect if they failed to verify a certificate because they will not expect the server to present a different certificate on reconnect. They expect the server to do it properly the first time.

Improve this answer
2
  • The server can't be certain of most validation factors, but it should be able to determine if the EE cert or an offered chain cert is expired, which only requires knowing the current time. Commented Jan 27, 2017 at 8:06
  • 1
    @dave_thompson_085: in theory the server could check for expired. But, if you have a new cert already why not install it per default. And if you don't have the new cert this check would not help anything. Thus I think this check is more part of the server administration and certificate renewal process but does not really belong inside the server itself. Commented Jan 27, 2017 at 8:29

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.