IPv6, HTTPS, and SNI

Server NGINX
1

Hi,

I am having in issue using https with multiple sites on ipv6 (nominally
SNI). If I declare more than one listen directive for ipv6 on port 443
nginx refuses to start. The ipv4 configuration is fine, it’s only an
issue with ipv6.

Nginx details:

nginx version: nginx/1.9.7
built by gcc 4.9.2
built with OpenSSL 1.0.1k 8 Jan 2015
TLS SNI support enabled

Configuration looks like:

server {
listen 80
listen [::]:80;
listen 443 ssl;
listen [::]:443 ssl;
server_name my_site.com;
ssl_certificate my_site.com.crt;
ssl_certificate_key my_site.com.key;
…
}
server {
listen 80;
listen [::]:80;
listen 443 ssl;
listen [::]:443 ssl;
server_name your_site.com;
ssl_certificate your_site.com.crt;
ssl_certificate_key your_site.com.key;
…
}

Does anyone have an idea on why this might be occurring? In theory ipv6
shouldn’t make a difference, and it sure as heck doesn’t make a
difference to the ipv4 configuration.

2

I seem to recall that with ipv6 you can’t mix 80 with 443 in one server
configuration, but I might be wrong here.

Posted at Nginx Forum:

3

Hi,

listen 80;

Afaik this will make nginx listen to both IPv4 and IPv6 family.

Specify the real IPv4 adress you want to listen to, to avoid the IPv6
bind.

listen [::]:80;

This will make nginx to listen to both IPv6 and IPv4 family.

Specify ipv6only=on [1] as a keyword to avoid the IPv4 bind.

Same goes for 443/ssl.

Imho, what you want is just listen to both address-families
(without declaring IPv6):
listen 80;
listen 443 ssl;

Regards,

Lukas

[1] Module ngx_http_core_module

4

Hello!

On Mon, Dec 07, 2015 at 08:00:40PM +1000, Nikolai Lusan wrote:

I am having in issue using https with multiple sites on ipv6 (nominally
SNI). If I declare more than one listen directive for ipv6 on port 443
nginx refuses to start. The ipv4 configuration is fine, it’s only an
issue with ipv6.

Please define “refuses to start”. It should print error details
to stdout if startup fails for some reason, and will log anything
to error log as well.

–
Maxim D.
http://nginx.org/

5

Hello!

On Mon, Dec 07, 2015 at 01:16:06PM +0100, Lukas T. wrote:

listen 80;

Afaik this will make nginx listen to both IPv4 and IPv6 family.

Specify the real IPv4 adress you want to listen to, to avoid the IPv6 bind.

No, just a port means IPv4 wildcard address.

listen [::]:80;

This will make nginx to listen to both IPv6 and IPv4 family.

Specify ipv6only=on [1] as a keyword to avoid the IPv4 bind.

No, IPv6-and-IPv4 listen sockets will be created if and only if
you’ll explicitly set the ipv6only parameter to off.

(Before nginx 1.3.4, the operation system setting was used as a
default for ipv6only. This was proven to be a wrong approach, and
now nginx forces ipv6only=on by default. See
Module ngx_http_core_module for some more details.)

–
Maxim D.
http://nginx.org/

6

Nikolai Lusan:

In theory ipv6 shouldn’t make a difference, and it sure as heck
doesn’t make a
difference to the ipv4 configuration.

Maybe not what you expect/like to hear:

Why does my head hurt if I run against a wall?
-> simply don’t do that.

IPv6 is more then IPv4 with longer addresses.
same here: generally there’s no need for SNI on IPv6
Take one address per service and you’re fine.

Andreas

7

Hello!

On Mon, Dec 07, 2015 at 06:32:32AM -0500, itpp2012 wrote:

I seem to recall that with ipv6 you can’t mix 80 with 443 in one server
configuration, but I might be wrong here.

You recall it incorrectly.

–
Maxim D.
http://nginx.org/