Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've been searching pretty long for this one, but nothing I seem to read works right -- maybe I'm not searching for the right things. Anyway, we have a www.example.com and a secure.example.com. I'm able to successfully redirect insecure requests to SSL on the secure subdomain, but I'm having trouble redirecting secure requests on the www subdomain to the secure subdomain. The following is my nginx.conf -- can anyone give me a hand? Thanks!

worker_processes  4;
error_log  /var/log/nginx/error.log;
events {
    worker_connections  4096;
}
http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;
    gzip  on;
    gzip_static on;
    gzip_min_length 1000;
    gzip_proxied    expired no-cache no-store private auth;
    gzip_types  text/plain application/xml;
    gzip_disable  "MSIE [1-6]\.";
    gzip_vary on;

    upstream example {
      server unix:/home/deploy/tmp/sockets/unicorn.sock;
    }
    server {
        listen 443;
    server_name www.example.com;
    rewrite        ^ https://secure.example.com$request_uri? permanent;
    }
    server {
    listen 80;
        server_name  www.example.com;
        location ~* ^.+\.(jpg|jpeg|gif|png|ico|css|js|swf|haml|ttf|eot|woff|svg)$ {
        root /home/deploy/example/current/public;
        expires max;
        access_log off;
      }
      location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto http;
        proxy_set_header Host $http_host;
        proxy_redirect off;
        client_max_body_size 25M;
        error_page   500 501 502 503 504 /temporarily_down.html;
        proxy_pass  http://example;
      }
      location /temporarily_down.html {
          root /home/deploy/example/current/public;
      }
     }
     server {
         listen 443 default_server ssl;
         server_name  secure.example.com;
         ssl on;
         ssl_certificate      /etc/ssl/staging_combined.crt;
         ssl_certificate_key  /etc/ssl/staging.key;
         ssl_session_timeout  5m;
         ssl_protocols  SSLv3 TLSv1;
         ssl_ciphers  RC4:HIGH:!aNULL:!MD5:!kEDH;
         ssl_prefer_server_ciphers   on;
         if ($ssl_protocol = "") {
          rewrite ^   https://$server_name$request_uri? permanent;
         }
         location ~* ^.+\.(jpg|jpeg|gif|png|ico|css|js|swf|haml|ttf|eot|woff|svg)$ {
             root /home/deploy/example/current/public;
             expires max;
             access_log off;
         }
         location / {
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto https;
             proxy_set_header Host $http_host;
             proxy_redirect off;
         error_page   500 501 502 503 504 /temporarily_down.html;
         client_max_body_size 25M;
             proxy_pass http://example;
         }
         location /temporarily_down.html {
              root /home/deploy/example/current/public;
         }
    }
}
share|improve this question
1  
An SSL connection needs to undergo a handshake/certificate exchange before any redirect can occur. The server block doing the redirect has no certifcate setup. –  cyberx86 Apr 9 '12 at 18:55
    
Try adding "ssl on" in the first server block which is intended to catch https requests to the primary domain –  WerkkreW Apr 9 '12 at 18:58
    
I see, so I'd have to do something like have a certificate for the root domain .example.com and then have that server redirect it to secure.example.com -- maybe I can use a cheap cert for the catchall and then just use a premium verified for the secure.example.com? –  paulnsorensen Apr 9 '12 at 19:48

1 Answer 1

Had the same problem - just make sure the 443 redirect server block has "ssl on".

So in your example;

server {
    listen 443;
    server_name www.example.com;

    ssl on;
    ssl_certificate      /etc/ssl/staging_combined.crt;
    ssl_certificate_key  /etc/ssl/staging.key;
    ssl_session_timeout  5m;
    ssl_protocols  SSLv3 TLSv1;
    ssl_ciphers  RC4:HIGH:!aNULL:!MD5:!kEDH;
    ssl_prefer_server_ciphers   on;
    rewrite        ^ https://secure.example.com$request_uri? permanent;
}
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.