Thank you.
I finally did it. This is how:
I created a proxy host including both the main domain and the sandbox domain. I set it with scheme http, forward port 3000 and enabled websockets support. In the Advanced tab I inserted:
location ^~ /cryptpad_websocket {
proxy_pass http://[CRYPTPAD-LOCAL-IP]:3003;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
client_max_body_size 150m;
}
Then I created only one certificate for the two domains.
Cheers