add golive-ssl-fix.sh: raise server_names_hash_bucket_size so agency :443 SNI matches (fixes cert-selection)

55142be0630c7ab2720b3bb09477791c617c0e4c · 2026-08-13 13:23:21 -0700 · Steve Abrams

Files touched

A golive-ssl-fix.sh

Diff

commit 55142be0630c7ab2720b3bb09477791c617c0e4c
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Aug 13 13:23:21 2026 -0700

    add golive-ssl-fix.sh: raise server_names_hash_bucket_size so agency :443 SNI matches (fixes cert-selection)
---
 golive-ssl-fix.sh | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/golive-ssl-fix.sh b/golive-ssl-fix.sh
new file mode 100644
index 0000000..509085e
--- /dev/null
+++ b/golive-ssl-fix.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Fix: agency.agentabrams.com :443 vhost isn't matching SNI because the box's
+# server_names_hash can't register all names (the long-standing
+# "could not build optimal server_names_hash" warning). Recommended remedy:
+# raise server_names_hash_bucket_size. Idempotent + backed up + nginx -t gated.
+# Run from Mac2:  bash ~/Projects/abramsagency/golive-ssl-fix.sh
+set -euo pipefail
+SRV=root@45.61.58.125
+HOST=agency.agentabrams.com
+
+ssh -o StrictHostKeyChecking=accept-new "$SRV" 'bash -s' <<'EOS'
+set -e
+C=/etc/nginx/nginx.conf
+cp -n "$C" "$C.bak-ssl-agency" 2>/dev/null || true
+if grep -qE '^\s*server_names_hash_bucket_size' "$C"; then
+  sed -i -E 's/^\s*server_names_hash_bucket_size[[:space:]]+[0-9]+;/    server_names_hash_bucket_size 128;/' "$C"
+else
+  # insert just after the first "http {" line
+  awk 'NR==1{f=0} /http[[:space:]]*\{/ && !f {print; print "    server_names_hash_bucket_size 128;"; f=1; next} {print}' "$C" > "$C.tmp" && mv "$C.tmp" "$C"
+fi
+echo "== directive now:"; grep -n 'server_names_hash_bucket_size' "$C" || echo "(not found — check manually)"
+nginx -t && systemctl reload nginx && echo NGINX_RELOADED
+EOS
+
+echo "== verify the cert served for $HOST SNI (want CN=$HOST, not 1800swallpaper) =="
+echo | timeout 12 openssl s_client -servername "$HOST" -connect 45.61.58.125:443 2>/dev/null | openssl x509 -noout -subject 2>/dev/null || true
+curl -s -m 15 -o /dev/null -w "https status=%{http_code}\n" "https://$HOST/" || true

← 11c9639 golive: fix SSL — serve ACME challenge from webroot (not pro · back to Abramsagency · add golive-http-only.sh fallback: serve clean HTTP (drop 301 9a64fc9 →