1

I have a Nginx web server (containerized, but that does not matter here) that serves http and https sites on several different domains.

For one of the domains there are several subdomains where I'd like to redirect all http and https requests to one domain. Here's the relevand Nginx configuration bit:

server {
    listen      80;
    listen      443 ssl;
    server_name *.example.com;
    return 301  https://example.com$request_uri;
}

But when I make request for https://www.example.com/about.html, I get a security warning, that the site certificate is invalid. Checking for the certificate reveals that Nginx has served the site with SSL certificate from another domain, apparently the first matching Nginx config with SSL certifixate. I can "accept risk and continue", and then the redirect goes through.

What would be configuration for a more appropriate handling that does not confront user with security warning and irrelevant SSL certificate?

5
  • 1
    You need a wildcard cert for your domain. Name so all its sub domains are signed.
    – davidgo
    Apr 27 '20 at 9:10
  • See configuring HTTPS servers. Apr 27 '20 at 9:24
  • Do you need the "listen 443 ssl" in the http server block? Doesn't it have a separate server block for https otherwise nginx cannot distinguish between them. You are effectively redirecting https to https. Apr 27 '20 at 9:29
  • @AdmiralNoisyBottom am I? There is a server block with listen 443 and server_name example.com, and it handles requests well. Also, the http redirects from *.example.com work fine. My problem is with https redirects from *.example.com.
    – Passiday
    Apr 27 '20 at 10:48
  • Having not used *.example.com myself I'm not sure if it's the * which is confusing. * is only used to catch things like products.example.com, mail.example.com, test.example.com etc. They are all separate sites which is why 1 certificate for example.com will be invalid on anything but example.com. Apr 28 '20 at 1:40
2

First of all, you will need a Wildcard SSL Certificate. Without a Wildcard Certificate you will need to get a certificate for each sub-domain being served. I believe the lack of a Wildcard Certificate is your biggest issue.

The second thing I would change is the contents of your server block.

server {
    listen      80;
 //   listen      443 ssl; # Should not be here
    server_name *.example.com;
    return 301  https://example.com$request_uri;
}

Now add an additional server block for HTTPS only.

server {
    listen 443 ssl;
    server_name *.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;     
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

# Include other configuration such as document root etc as required

}

I believe the method you were using is effectively redirecting both http & https to https. Someone will correct me if I'm wrong on this.

By having separate blocks for HTTP & HTTPS the .conf file is more readable, in my opinion, and clearer.

3
  • The problem is that I don't have (and don't plan to have) neither wildcard certificate, nor collection of sub-domain certificates. If the https redirect is not possible without them, can I at least get a better behavior than serving the site with some other sites certificate? I don't know, even 404 is better.
    – Passiday
    Apr 27 '20 at 11:09
  • 1
    In your original question you said "for one of the domains there are several subdomains" and the only method for the subdomains is a wildcard certificate for the main domain which covers those subdomains, or seperate certificate for each subdomain. In your example you have *.example.com which implies subdomains. You can get wildcard or as many subdomain certs from letsencrypt for free. You can have https for main domain and http for subdomains though. Perhaps I'm misunderstanding what you're after. Apr 28 '20 at 1:36
  • Those subdomains are old legacy URLs that just need to be redirected. I was hoping there's a way to avoid creating a certificate for every one of them just for such a tiny task. But I guess, telling the client "status 301" is just a normal communication that has to be secured with a proper certificate, if it's over https.
    – Passiday
    Apr 28 '20 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.