File options-ssl-nginx.conf can’t be used with multiple virtual hosts
- Dominant language
- Python
- Stars
- 33.2k
- Forks
- 3.5k
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 3
Description
## My operating system is (include version):
Ubuntu 24.04 LTS
## I installed Certbot with (snap, OS package manager, pip, certbot-auto, etc):
- Certbot 2.9.0
- NGINX 1.26.1
## I ran this command and it produced this output:
This is described more in detail [here][10]:
[10]: https://community.letsencrypt.org/t/file-options-ssl-nginx-conf-cant-be-used-with-multiple-virtual-hosts/223462/4
* I've a certificate generated for two subdomains
* I've tried to include `/etc/letsencrypt/options-ssl-nginx.conf` in two `server{}` sections which are under an `http{}` (each `server{}` is dedicated to an HTTP virtual host and a subdomain).
* Then I've tried to include the same file to a third `server{}` section that is under a `stream{}` parent. The purpose of the latter is proxying (via SSL termination) an internal Neo4j server, which uses the BOLT protocol (TCP/WebSocket protocol)
## Certbot's behavior differed from what I expected because:
When testing with `nginx -t`, I got this:
```log
nginx: [emerg] the shared memory zone "le_nginx_SSL" is already declared for a different use in /etc/letsencrypt/options-ssl-nginx.conf:7
nginx: configuration file /etc/nginx/nginx.conf test failed
```
* It works fine if I eliminate the third inclusion
* It works fine if I change that `options-ssl-nginx.conf` file, so that it doesn't have the non-common parts (ie, the cache name), but I'm wary of doing so, since the file's comments say it shouldn't be touched.
I think SSL caches aren't reusable everywhere and hence the Let's Encrypt-provided file can't be included as-is both in the http{} and stream{} sections. Nor can it be placed out of these sections (I've tried previously and nginx says the directives are in a bad place).
Possible solution: change certbot, so that, when using --nginx it places the cache naming directive in the existing config file, rather than in the above to-be-included file.
## Here is a Certbot log showing the issue (if available):
Please, see details at the [above-entioned discussion][10]
## Here is the relevant nginx server block or Apache virtualhost for the domain I am configuring:
Ditto
Contributor guide
Assessment
This issue has not been assessed yet.