2

So I'm using Nginx (1.4.3) to reverse proxy a domain and sub-domains. I installed SSL certs to handle the main domain (example.com) and a couple sub-domains (lets say test.example.com and mail.example.com). So I naturally used a 301 return to move http requests to https.

server {
   listen 80 default_server;
   server_name example.com www.example.com;
   return 301 https://example.com$request_uri;
}

Works great. But if I introduce another sub-domain that I don't want under the HTTPS SSL Certs (because I don't have a wildcard cert and don't need it for this subdomain). Nginx still seems to apply the 301 to it, even though the server_name has been implicitly set. Since it's 1.4.3 I've split them up in the conf.d folder.

I figure it is doing this because if I clear my browser cache, and navigate to the new sub domain (sd.example.com) it works fine and doesn't rewrite to https. But then if I go to the main site (example.com) the rewrite kicks in, I get sent to https://example.com, and no problems there. But then, if I try and go back to sd.example.com, I get rewritten to https://sd.example.com and the big red chrome error pops up.

Any ideas why this is happening? I'd prefer to stop banging my head around on this one.

  • 2
    Did you set secure cookies or HSTS? – Michael Hampton Nov 19 '13 at 1:37
  • That was quick. No to the secure cookies, but there is a HSTS I noticed. Never thought of that, would that do it? – CP510 Nov 19 '13 at 1:40
  • 1
    Well that was dumb of me. The HSTS did include the includeSubDomains directive. I comment it out and it works now. HSTS is new to me so I forgot about it. – CP510 Nov 19 '13 at 1:44
2

posted answers from OP comment

The problem was caused by HSTS header. In main domain, there is entry includeSubDomains in HSTS header . If a browser visits main domain and receive that HSTS header, the browser will force to connect via HTTPS in main domain and subdomain too. So, its pretty clear that nginx doesn't cause the redirection.

If you don't want subdomain use HTTPS, the solution is remove includeSubDomains in HSTS header.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.