Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to force ssl redirect, but my domain has a port like so domain.com:8888

The following doesn't seem to be working, now I am not even able to access the site if I add the rewrite

server {
    listen 8888;
    server_name sy-system.net;
    rewrite     ^   https://$server_name:8888$request_uri? permanent; 

    ssl on;
    ssl_certificate /path/to/certs/domain.pem;
    ssl_certificate_key /path/to/certs/domain.key;
}
share|improve this question
    
[A possible answer][1] Should have all feature except permanent(301) forwarding. [1]: stackoverflow.com/questions/14144514/… –  Yifu Yu Apr 10 '13 at 7:11
add comment

2 Answers

It isn't possible to handle both SSL and non-SSL requests on a single port. You'll need to use a second port for the SSL version if you want to serve both on the same domain.

share|improve this answer
    
Hi I only intend to serve SSL, and I don't want people accessing the site with non-ssl and giving them a bad request –  zentenk Feb 13 '12 at 14:37
1  
ssl connection comes before you can be served by webserver (and configured rewrites on it) as Jason said - if you need redirection from not ssl - you have to use another port or teach users to use ssl at once; as 8888 is not default ssl port the browser would try to connect to it with no ssl communication - so it would fail –  Arek B. Feb 13 '12 at 15:07
add comment

There are two ways to do this, through a dual HTTP HTTPS server block or using two server blocks (preferred) This uses one server block to listen to the 8888 port and the standard 443 SSL port.

# Server accepts 8888 and SSL but redirects to HTTPS when no SSL protocol used
server {
    listen   8888;            # usually 80
    listen   443 ssl;

    server_name example.com; # replace example.com with your domain name

    ssl on;
    ssl_certificate /path/to/certs/domain.pem;
    ssl_certificate_key /path/to/certs/domain.key;

    if ($ssl_protocol = "") {
         rewrite (.*) https://$server_name$1 permanent;
    }
}

There is another way that avoids if statements by splitting the server into two blocks.

# SSL Site
server {
    listen   443 ssl;
    server_name example.com; # replace example.com with your domain name

    ssl on;
    ssl_certificate /path/to/certs/domain.pem;
    ssl_certificate_key /path/to/certs/domain.key;
}

# Non-SSL Site
server {
    listen   8888;            # usually 80
    server_name example.com; # replace example.com with your domain name

    rewrite (.*) https://$server_name$1 permanent;
}

Please note that these were not tested since I use standard ports (80,443) but inferred from reading the documentation. You might also want to include the IP Address in the listen statement since SSL must be bound to a dedicated IP anyways.

Sources:

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.