By using https://IP to access the server, the default unconfigured Nginx will return the first SSL certificate to the visitor, but this is very insecure, and I don't want others to know that the certificate is deployed on my server .

# Generate a self-signed SSL certificate

Fortunately, we can configure the nginx.conf file to avoid this problem. First of all, we need to obtain a self-signed SSL certificate. If you don’t know how to generate it, you can read this article: *How to generate a self-signed SSL certificate? *

Create a new fk folder in the root directory, put the generated pem file and key file in the fk folder, and then modify the nginx configuration file, the default location is /usr/local/nginx/conf/nginx.conf.

# Modify nginx.conf

We only need to modify the server field, the original should be as shown in the following code segment.

server
{
    listen 80 default_server reuseport;
    #listen [::]:80 default_server ipv6only=on;
    server_name_;
    index index.html index.htm index.php;
    root /home/wwwroot/default;

Modify it to:

server
{
    listen 80 default_server reuseport;
    listen 443 ssl http2;
    server_name_;
    server_name_in_redirect off;
    ssl_certificate /root/fk/ssl.pem;
    ssl_certificate_key /root/fk/ssl.key;
    return 500;

In this way, accessing through https://IP will return an SSL error, and the visitor will get our self-signed fake certificate, and will not get the real certificate domain name we deployed.