1

I've currently got a floating IP pointing at a server hosting a number of sites, some with SSL, others without.

I need to shutdown, backup and resize said server - and was hoping to setup a simple holding page on a small VPS instance - swap over the floating IP, catching all the traffic and redirecting.

I had this running using 'servername _' as a wildcard to catch all domain names, however (despite the port being open) - I was unable to access the site at the HTTPS address - and when I added a scheme based redirect (directing to HTTP) - this didn't appear to have any effect?

Any help much appreciated. I imagine it's probably a relatively simple nginx server block.

5
  • 1
    You may not have been blocking the port at the firewall level, but are you definitely sure nginx was listening on 443 and you had configured SSL directives appropriately? I would have assumed you would want to do one for each certificate your setup is using, so no SSL errors for wrong cert or whatever are presented to the client. Also, you don't need to try and wildcard the server_name directive, if you have a single server block listening on port 80 it will automatically get all the traffic on port 80 (as there will be no more specific match for it).
    – Carcer
    Jan 11, 2016 at 9:17
  • Okay - sounds like the issue was not correctly setting up SSL. Server was indeed listening on that port (checked via scan) - but was throwing errors visiting any page via HTTPS. Can I route all HTTPS traffic to HTTP to avoid setting up the SSL cert. for all sites? Jan 12, 2016 at 0:55
  • 1
    Unfortunately, no, if the browser attempts to connect on https and doesn't get a valid handshake/certificate out of it, it will error. You will need to set up those certs if you want to catch the traffic, even if you are subsequently redirecting it.
    – Carcer
    Jan 12, 2016 at 9:27
  • Thanks Carcer - sounds like a case of duplicating all cert. to the 'holding' server - setting up correct SSL directives and I'll avoid the errors I've been seeing. Thanks for your help. Much appreciated. Jan 13, 2016 at 10:31
  • Sure. I've written out the salient details as an answer below.
    – Carcer
    Jan 13, 2016 at 11:40

2 Answers 2

1

As per the comments, if you want to catch traffic on HTTPS, you must define a server block which serves up the right SSL certificates for the domains in question. SSL negotiation takes place before you can send a redirect to the browser, and if nginx can't provide a valid certificate for the domain there will be errors.

You only need a single server block listening on port 80 to catch all HTTP and serve your static holding page though; you shouldn't even need to declare server_name as it will presumably be the only block which matches port 80 traffic anyway (or you could use listen 80 default_server; so that it is definitely used by otherwise uncaught traffic if you are serving other domains that need to be kept separate).

I would personally recommend that for each ssl server block you serve the holding page directly rather than redirecting to another domain (or even non-https same domain) which serves the page, if only to avoid confusing google and other search engines which are crawling your domains.

1

Classic SSL setups involved required having a unique IP address for every SSL certificate. You haven't mentioned if is what you are doing or not. If this is the case, then simply point one IP at the temporary VPS won't be sufficient to make the SSL sites appear-- all the IP addresses for the SSL site will need to be pointed there as well.

More recently, SNI was created to allow serving multiple SSL certificates from a single IP address. The drawback to this approach is reduced browser support. If you use SNI or are willing to, then you can serve all your domains off a single IP address whether they need SSL or not.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .