title: NGINX ignore bad certificate and configuration and just run?
body: <p>We have an app that uploads automatically generated SSL certificate to our NGINX load balancers. One time the we had this issue that a "bad certificate" got uploaded and then a automated <code>nginx reload</code> is thereafter executed, our server went offline for a while causing DNS issues (DNS not found) for our server domain. Causing a huge downtime to our clients. </p>
  
  <p>However it is a feature / function in our application to allow apps to upload SSL cerficate and our backend server installs it automatically, is there a way to tell to ignore bad NGINX <code>conf</code> files and <code>crt/key</code>'s altogether? <em>Looking at the before logs I can remember that I saw something like SSL handshake error before the incident.</em> </p>
  
  <p>Here's how our main <code>nginx-jelastic.conf</code> looks like:</p>
  
  <pre><code>######## HTTP SECTION PROTOTYPE ########
  http {
      server_tokens off ;
      ### other settings hidden for simplicity
      include /etc/nginx/conf.d/*.conf;
  }
  ######## TCP SECTION PROTOTYPE ########
  </code></pre>
  
  <p>So what I am thinking if it's possible for nginx to just ignore all bad NGINX conf files that is located there. Here's a sample of what gets uploaded in the <code>conf.d</code> folder:</p>
  
  <p>#</p>
  
  <h1>www.example-domain.com HTTPS server configuration</h1>
  
  <p>#</p>
  
  <pre><code>server {
      listen 443 ssl;
      server_name www.example-domain.com;
      ssl_certificate /var/lib/nginx/ssl/www.example-domain.com.crt;
      ssl_certificate_key /var/lib/nginx/ssl/www.example-domain.com.key;
      access_log /var/log/nginx/localhost.access_log main;
      error_log /var/log/nginx/localhost.error_log info;
      proxy_temp_path /var/nginx/tmp/;
      error_page   500 502 503 504  /50x.html;
  
      location = /50x.html {
          root   html;
      }
  
      location / {
          set $upstream_name common;
          include conf.d/ssl.upstreams.inc;
          proxy_pass http://$upstream_name;
          proxy_next_upstream error;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Host $http_host;
          proxy_set_header X-Forwarded-For $http_x_forwarded_for;
          proxy_set_header X-URI $uri;
          proxy_set_header X-ARGS $args;
          proxy_set_header Refer $http_refer;
          proxy_set_header X-Forwarded-Proto $scheme;
      }
  }
  </code></pre>
  
  <p>For some reason the certificate and key indicated in the configuration could be wrong, that that is going to wreck the nginx server and since our domain is pointed to this server via A record, it us a total disaster if the nginx fails as DNS issues happens and it could take 24-48 hours for DNS to get back. </p>