Support multiple acme_certificates per server (enable hybrid ECDSA + RSA configs)

[maxprehl]

Feature Overview

I would like to be able to configure an acme-enabled server to support hybrid ECC/RSA aka multi-cert configurations.

I propose this to be done by allowing multiple acme_certificate directives within a server.

Alternatives Considered

I am currently able to configure this manually by providing multiple ssl_certificate and ssl_certificate_key directives inside a server. This allows my web server to offer both EC and RSA keys. This is explicitly mentioned in ngx_http_ssl_module docs

Since version 1.11.0, this directive can be specified multiple times to load certificates of different types, for example, RSA and ECDSA:

For example, the config i'm currently using looks like this:

server{
  listen 0.0.0.0:443 ssl http2 default;
  listen [::]:443 ssl http2 default;
  #...
  ssl_certificate /etc/ssl/private/httpd_ecc.pem;
  ssl_certificate_key /etc/ssl/private/httpd_ecc.pem;
  ssl_certificate /etc/ssl/private/httpd.pem;
  ssl_certificate_key /etc/ssl/private/httpd.pem;
  #...
}

But when configuring with acme_certificate I get an error from the config checker that duplicates are not allowed.

Attempted configuration:

server{
  listen 0.0.0.0:443 ssl http2 default;
  listen [::]:443 ssl http2 default;
  #...
  acme_certificate staging key=ecdsa:256
  ssl_certificate $acme_certificate;
  ssl_certificate_key $acme_certificate_key;
  
  acme_certificate staging key=rsa:2048
  ssl_certificate $acme_certificate;
  ssl_certificate_key $acme_certificate_key;
  #...
}

Error from nginx -T

2026/05/11 12:33:22 [emerg] 378#378: "acme_certificate" directive is duplicate in /etc/nginx/conf.d/alice-acme.conf:63
nginx: [emerg] "acme_certificate" directive is duplicate in /etc/nginx/conf.d/alice-acme.conf:63

Additional Context

This was tested using nginx_module_acme version 0.3.1. I'll test shortly with 0.4.1 but the release notes didn't indicate anything would be different.

If there's a workaround using multiple server entries, i'm all ears, but I'd definitely prefer something similar to how the existing multi-ssl_certificate is implemented.