Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a bit of a problem. We run a wordpress blog behind a ngnix proxy and looking to terminate the ssl on the nginx side. Our current nginx config is

upstream admin_nossl {

   server {

        ssl                  on;
        ssl_certificate      /etc/nginx/;
        ssl_certificate_key  /etc/nginx/;
        ssl_session_timeout  5m;
        ssl_protocols  SSLv2 SSLv3 TLSv1;
        ssl_prefer_server_ciphers   on;
        ssl_session_cache  shared:SSL:10m;
        ssl_ciphers RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;

        location / {
           proxy_read_timeout 2000;
           proxy_next_upstream error;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header Host $http_host;
           proxy_redirect off;
           proxy_max_temp_file_size 0;
           proxy_pass http://admin_nossl;

It just does not seem to work. If I can hit but it quickly switches back to non-secured from what I can see.

Any pointers?

share|improve this question
up vote 1 down vote accepted

You are going to have a difficult time with this, as Wordpress has redirects all over the place with many of them being in .htaccess files.

If you specify the "Wordpress URL" in the settings as well as any reference to the URL throughout the configuration as https, it will probably work. I doubt it is your ngix configuration at this point but it would be easy enough to test with a different VirtualHost not running Wordpress.

share|improve this answer

I disagree with Warner. This should be completely easy. The only issue would be that Apache things all requests are coming from the same IP and you've already fixed that with X-real-ip header. Looks like you're not adding the listen option in your server block.

I have two server blocks listening to the server_name one one port 80 and one on port 443. I put all the SSL specific stuff in the latter. No problems here. Try doing the same.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.