2

I am trying to force ssl redirect, but my domain has a port like so domain.com:8888

The following doesn't seem to be working, now I am not even able to access the site if I add the rewrite

server {
    listen 8888;
    server_name sy-system.net;
    rewrite     ^   https://$server_name:8888$request_uri? permanent; 

    ssl on;
    ssl_certificate /path/to/certs/domain.pem;
    ssl_certificate_key /path/to/certs/domain.key;
}
1

3 Answers 3

3

It isn't possible to handle both SSL and non-SSL requests on a single port. You'll need to use a second port for the SSL version if you want to serve both on the same domain.

2
  • Hi I only intend to serve SSL, and I don't want people accessing the site with non-ssl and giving them a bad request
    – zentenk
    Commented Feb 13, 2012 at 14:37
  • 1
    ssl connection comes before you can be served by webserver (and configured rewrites on it) as Jason said - if you need redirection from not ssl - you have to use another port or teach users to use ssl at once; as 8888 is not default ssl port the browser would try to connect to it with no ssl communication - so it would fail
    – Arek B.
    Commented Feb 13, 2012 at 15:07
3

There are two ways to do this, through a dual HTTP HTTPS server block or using two server blocks (preferred) This uses one server block to listen to the 8888 port and the standard 443 SSL port.

# Server accepts 8888 and SSL but redirects to HTTPS when no SSL protocol used
server {
    listen   8888;            # usually 80
    listen   443 ssl;

    server_name example.com; # replace example.com with your domain name

    ssl on;
    ssl_certificate /path/to/certs/domain.pem;
    ssl_certificate_key /path/to/certs/domain.key;

    if ($ssl_protocol = "") {
         rewrite (.*) https://$server_name$1 permanent;
    }
}

There is another way that avoids if statements by splitting the server into two blocks.

# SSL Site
server {
    listen   443 ssl;
    server_name example.com; # replace example.com with your domain name

    ssl on;
    ssl_certificate /path/to/certs/domain.pem;
    ssl_certificate_key /path/to/certs/domain.key;
}

# Non-SSL Site
server {
    listen   8888;            # usually 80
    server_name example.com; # replace example.com with your domain name

    rewrite (.*) https://$server_name$1 permanent;
}

Please note that these were not tested since I use standard ports (80,443) but inferred from reading the documentation. You might also want to include the IP Address in the listen statement since SSL must be bound to a dedicated IP anyways.

Sources:

1

It is possible.

If you you are using the port in the URI:

    server {
        listen 8888 ssl; # listen for ipv4; this line is default and implied
        ssl on;
        ssl_certificate /path/to/certs/domain.pem;
        ssl_certificate_key /path/to/certs/domain.key;
        error_page 497 https://$server_name:8888$request_uri;
    }

For no port in URI:

    server {
        listen 8888 ssl;
        ssl on;
        ssl_certificate /path/to/certs/domain.pem;
        ssl_certificate_key /path/to/certs/domain.key;
        error_page 497 https://$server_name$request_uri;
    }

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .