Why Nginx may pass incorrect ssl sertificate? - nginx

Question

I've got two domains hosted per single nginx server, ex. a.com and b.com. Nginx used as reverse proxy and must pass https requests to backend as http. You can find bellow my config for a.com (b.com has the same structure but linked to another ssl files):
upstream webservers {
....
}
server {
listen 443 ssl;
server_name a.com;
ssl_certificate /etc/nginx/ssl/a.crt;
ssl_certificate_key /etc/nginx/ssl/a.key;
ssl_dhparam /etc/nginx/ssl/default.dh;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://webservers;
}
}
Unfortunately, when I test curl https://b.com it fails with curl: (60) SSL: no alternative certificate subject name matches target host name b.com. When I try to open it from browser it fails with NET::ERR_CERT_COMMON_NAME_INVALID and it shows that it use a.com certificate.
Where is my mistake?
Upd#1
I have to allow HTTP to solve issue temporary.
openssl s_client -connect b.com:443 -prexit
140648924489024:error:2008F002:BIO routines:BIO_lookup_ex:system lib:../crypto/bio/b_addr.c:726:Name or service not known
connect:errno=22
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 0 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
Configurations:
# configuration file /etc/nginx/sites-enabled/a.com:
upstream a-webservers {
server 192.168.0.252 max_fails=3 fail_timeout=30s;
server 192.168.0.252 max_fails=3 fail_timeout=30s;
}
server {
listen 443 ssl;
server_name a.com;
error_log /var/log/nginx/a.com-error.log;
access_log off;
ssl_certificate /etc/nginx/ssl/a.crt;
ssl_certificate_key /etc/nginx/ssl/a.key;
ssl_dhparam /etc/nginx/ssl/default.dh;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://a-webservers;
}
}
# configuration file /etc/nginx/sites-enabled/b.com:
upstream b-webservers {
server 192.168.0.252 max_fails=3 fail_timeout=30s;
server 192.168.0.252 max_fails=3 fail_timeout=30s;
}
server {
listen 80;
listen 443 ssl;
server_name b.com;
error_log /var/log/nginx/b.com-error.log;
access_log off;
ssl_certificate /etc/nginx/ssl/b.crt;
ssl_certificate_key /etc/nginx/ssl/b.key;
ssl_dhparam /etc/nginx/ssl/default.dh;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://b-webservers;
}
}