Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've been working on SSL stuff and getting nowhere from like 4 tutorials... I've bought an SSL for pingrglobe.com, and now trying to apply it to my servers. Here's my nginx code:

    http {
      server {
            listen 80;

            server_name pingrglobe.com;
            rewrite ^(.*) http://www.pingrglobe.com$1 permanent;
      }
      server {
        listen 443;
        ssl on;
        ssl_certificate /etc/nginx/ssl/pingrglobe.crt;
        ssl_certificate_key /etc/nginx/ssl/pingrglobe.key;
        #enables SSLv3/TLSv1, but not SSLv2 which is weak and should no longer be used.
        ssl_protocols SSLv3 TLSv1;
        #Disables all weak ciphers
        ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM;
        server_name www.pingrglobe.com;

            root /var/www/pingrglobe.com;
            index index.html index.php;

            location / {
                try_files $uri $uri/ @extensionless-php;
                add_header Access-Control-Allow-Origin *;
            }

            rewrite ^/blog/blogpost/(.+)$ /blog/blogpost?post=$1 last;  
            rewrite ^/viewticket/(.+)/(.*)$ /viewticket?tid=$1&$2 last;
            rewrite ^/vemail/(.+)$ /vemail?eid=$1 last;
            rewrite ^/serversettings/(.+)$ /serversettings?srvid=$1 last;
            rewrite ^/notification/(.+)$ /notification?id=$1 last;
            rewrite ^/viewreport/(.+)$ /viewreport?srvid=$1 last;
            rewrite ^/removeserver/(.+)$ /removeserver?srvid=$1 last;
            rewrite ^/staffviewticket/(.+)/(.*)$ /staffviewticket?tid=$1&$2 last;
            rewrite ^/activate/(.*)/(.*)/(.*)$ /activate?user=$1&code=$2&email=$3 last;
            rewrite ^/activate2/(.*)/(.*)/(.*)$ /activate2?user=$1&code=$2&email=$3 last;
            rewrite ^/passwordtoken/(.+)/(.*)/(.*)$ /passwordtoken?user=$1&token=$2&email=$3 last;
            location ~ \.php$ {
                try_files $uri =404;
                fastcgi_pass unix:/var/run/php5-fpm.sock;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                include fastcgi_params;
            }

            location @extensionless-php {
               rewrite ^(.*)$ $1.php last;
            }

            location ~ /\. {
               deny all;
            }
      }
    }

SSL doesn't work as you see here: https://www.pingrglobe.com

share|improve this question
    
Have you opened port 443 in your firewall? –  Pothi Oct 28 '13 at 7:37
2  
support previous comment. curl -I pingrglobe.com curl: (7) Failed connect to www.pingrglobe.com:443; Connection refused –  astlock Oct 28 '13 at 9:21
    
Change: listen 443; to listen 443 ssl; –  Andrei Mikhaltsov Oct 28 '13 at 11:18
    
Pothi - I've no firewall active. Andrei - Changed... still nothing! –  matrixdevuk Oct 28 '13 at 15:22
    
Here's something interesting: root@server2:~# nginx -t nginx: [emerg] "http" directive is not allowed here in /etc/nginx/sites-enabled/pingrglobe.com:1 nginx: configuration file /etc/nginx/nginx.conf test failed –  matrixdevuk Oct 28 '13 at 16:34

2 Answers 2

Replace your existing complete file content with the following at report back what nginx -t is says if you still can't reload.

# Redirect ALL non-https traffic to https
server {
    server_name pingrglobe.com *.pingrglobe.com;
    return 301 https://$server_name$request_uri;
}

# Redirect www to non-www
server {
    listen                 443 ssl;
    server_name            www.pingrglobe.com;
    return 301 $scheme://pingrglobe.com$request_uri;
}

server {
    listen                 443 ssl;
    server_name            pingrglobe.com;
    ssl_certificate        ssl/pingrglobe.crt;
    ssl_certificate_key    ssl/pingrglobe.key;
    ssl_protocols          SSLv3 TLSv1;
    ssl_ciphers            ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM;
    root                   /var/www/pingrglobe.com;
    index                  index.php index.html;

    location / {
        location ~ /\. {
            return 403;
        }

        add_header Access-Control-Allow-Origin *;

        rewrite ^/blog/blogpost/(.+)$ /blog/blogpost?post=$1 last;  
        rewrite ^/viewticket/(.+)/(.*)$ /viewticket?tid=$1&$2 last;
        rewrite ^/vemail/(.+)$ /vemail?eid=$1 last;
        rewrite ^/serversettings/(.+)$ /serversettings?srvid=$1 last;
        rewrite ^/notification/(.+)$ /notification?id=$1 last;
        rewrite ^/viewreport/(.+)$ /viewreport?srvid=$1 last;
        rewrite ^/removeserver/(.+)$ /removeserver?srvid=$1 last;
        rewrite ^/staffviewticket/(.+)/(.*)$ /staffviewticket?tid=$1&$2 last;
        rewrite ^/activate/(.*)/(.*)/(.*)$ /activate?user=$1&code=$2&email=$3 last;
        rewrite ^/activate2/(.*)/(.*)/(.*)$ /activate2?user=$1&code=$2&email=$3 last;
        rewrite ^/passwordtoken/(.+)/(.*)/(.*)$ /passwordtoken?user=$1&token=$2&email=$3 last;

        location ~ \.php$ {
            include          fastcgi_params;
            fastcgi_index    index.php;
            fastcgi_param    PATH_INFO          $fastcgi_path_info;
            fastcgi_param    PATH_TRANSLATED    $document_root$fastcgi_path_info;
            fastcgi_param    SCRIPT_FILENAME    $document_root$fastcgi_script_name;
            fastcgi_param    SCRIPT_NAME        $fastcgi_script_name;
            fastcgi_pass     unix:/var/run/php5-fpm.sock;
            try_files        $uri =404;
        }

        try_files $uri $uri/ @extensionless-php;
    }

    # The try_files directive in the php block mitigates security risks.
    location @extensionless-php {
        rewrite ^(.*)$ $1.php last;
    }

}
share|improve this answer

I had the same issue. The folllowing is what worked for me.

In order versions of Nginx, the http{} directive was part of default, and it included the default server{} directive.

In newer versions, the http directive is in it's own file, called nginx.conf, and it includes all the files that have been linked to in sites-enabled/

Most tutorials state (or imply) that you should create a http block in your virtual-host file, and put the ssl directives within it. However, that causes the http directive in the vhost to be included within the http directive in nginx.conf, and throws the err: "http" directive is not allowed here
(Or similar not allowed here errors if you have other commands before it.)

The solution is simply to include the SSL directives directly in nginx.conf instead of creating a new http directive inside the vhost file.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.