2

I'm having some issues redirecting from HTTPS www to HTTPS non-www with my nginx config. I'm following the directions provided at (Remove "www" and redirect to "https" with nginx).

Right now the following work:

But this doesn't:

I end up getting the "Welcome to nginx!" page. I don't have any other nginx config files in /sites-enabled either. Any ideas why it might be doing this?

My config file is below.

upstream redemfit {
    server unix:/srv/redemfit/run/gunicorn.sock fail_timeout=0;
}

server {
    listen         80;
    server_name    www.redemfit.com redemfit.com;
    rewrite        ^ https://redemfit.com$request_uri? permanent;
}

server {
    listen 443;
    ssl on;
    ssl_certificate /etc/ssl/private/redemfit-bundle.crt;
    ssl_certificate_key /etc/ssl/private/redemfit.key;
    ssl_protocols SSLv3 TLSv1;
    ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM;
    server_name www.redemfit.com
    rewrite ^ https://redemfit.com$request_uri? permanent;
}

server {
    listen   443;

    ssl on;
    ssl_certificate /etc/ssl/private/redemfit-bundle.crt;
    ssl_certificate_key /etc/ssl/private/redemfit.key;
    ssl_protocols SSLv3 TLSv1;
    ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM;

    server_name redemfit.com;

    client_max_body_size 4G;

    access_log /srv/redemfit/logs/nginx-access.log;
    error_log /srv/redemfit/logs/nginx-error.log;

    gzip on;
    gzip_disable "msie6";

    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

    location /static {
        auth_basic off;
        root /srv/redemfit/static_collected;
    }

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_redirect off;

        if (!-f $request_filename) {
            proxy_pass http://redemfit;
            break;
        }
    }
}

1 Answer 1

5

Try removing HTTPS server {} block for www.redemfit.com completely and add the code bellow into main HTTPS block:

if ($host = 'www.redemfit.com' ) {
          rewrite  ^/(.*)$  https://redemfit.com/$1  permanent;
}

I hope while writing the post you made a typo:

server {
    listen 443;
    ssl on;
    ssl_certificate /etc/ssl/private/redemfit-bundle.crt;
    ssl_certificate_key /etc/ssl/private/redemfit.key;
    ssl_protocols SSLv3 TLSv1;
    ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM;
    server_name www.redemfit.com # <- Missing semicolon
    rewrite ^ https://redemfit.com$request_uri? permanent;
}
2
  • This isn't a good solution for a couple of reasons. 1) Do not use rewrite when you are able to issue a redirect using return directive (for this solution it will be return 301 https://redemfit.com$request_uri;) to avoid an expensive PCRE library call. 2) This one will use a normalized URI to generate the Location HTTP header contents which may be a security flaw in some cases (see the Usage of $uri can lead to CRLF Injection chapter of the Common Nginx misconfigurations article. Jun 14, 2022 at 16:26
  • Generally due to the performance considerations (described here) using three server blocks (as shown here) is the best approach anyway. Jun 14, 2022 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .