9

I am trying to implement Flexible SSL provided by CloudFlare to my site.

Here is my nginx config:

# PHP-FPM upstream; change it accordingly to your local config!
upstream php-fpm {
    server 127.0.0.1:9000;
}

server {
    listen         80;
    server_name    example.com www.example.com;
    return         301 https://$server_name$request_uri;
}

server {
    ## Listen ports
    listen 443;

    # use _ if you want to accept everything, or replace _ with domain
    server_name example.com www.example.com;

    location / {
      #proxy_set_header        X-Forwarded-Proto $scheme;
      proxy_set_header X_FORWARDED_PROTO https;
      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header  Host $http_host;
      proxy_set_header  X-Url-Scheme $scheme;
      proxy_redirect    off;
      proxy_max_temp_file_size 0;
    }

(...rest of config...)

However, when I try to connect to the website (Wordpress), I get a redirect loop (chrome: ERR_TOO_MANY_REDIRECTS). How do I configure nginx to prevent this?

27

Cloudflare's flexible ssl means the connection between cloudflare and your server is always over http:

connection is always http

Given this - the only server block in the question of relevance is this one:

server {
   listen         80;
   server_name    example.com www.example.com;
   return         301 https://$server_name$request_uri;
}

It should be obvious why that results in a redirect loop, there are 2 solutions to force https connections using their flexible ssl solution.

Use Cloudflare's page rules

If access to the server is exclusively via cloudflare you can use cloudflare's own page rules to modify responses for a domain, subdomain, or any url pattern:

Using cloudflare's page rules

One of the options is to force https:

Always use HTTPS

Test $http_x_forwarded_proto

There are times you may want to avoid using page rules (should be rare or transitional only), for these scenarios it's possible to test the forwarded protocol and redirect based on that:

server {
   listen         80;
   server_name    example.com www.example.com;

   if ($http_x_forwarded_proto = "http") {
     return 301 https://$server_name$request_uri;
   }

   ... directives to generate a response
}
  • And will there be errors in my https connections such as not everything is transmitted over http in this case? – Deqq Dec 21 '14 at 12:19
  • How you setup cloudflare/nginx has no bearing on that, the html contents will determine if there are such errors reported. – AD7six Dec 21 '14 at 12:49
  • The first line of this answer is incorrect: the connection between the browser and CloudFlare is TLS encrypted, the connection from CloudFlare to the origin server is http. Redirect loops can be caused by page rules or high level setting specifying the encryption type incorrectly - eg full when you really need flexible. – Tim Apr 10 '16 at 4:48
  • @JLSJonas "there are 2 solutions to force https connections using their flexible ssl solution." Please don't edit this answer again to be about using full SSL, that is a different answer (which you are welcome to add) – AD7six Jun 1 '16 at 20:32
  • There's also a plugin that helps with this: en-nz.wordpress.org/plugins/cloudflare-flexible-ssl – Tim Oct 1 '16 at 20:41
5

This can fix the problem if you have the valid SSL certificate on your. [Crypto] box and select Full (strict) as in the image. enter image description here

Really no need to update the web server configuration file for Nginx.

  • Full (strict) only works if the origin web server has a valid SSL certificate with a valid certificate chain. Full works with any SSL certificate, including self signed. This isn't a good answer to the question. – Tim Oct 1 '16 at 20:40
  • Yes, I see now, the question mentioned the Flexible certificate. I will improve my answer thanks to your feedback and I will be more specific. We are improving the knowledge base in here. A valid SSL certificate has the best value for Google if we consider SEO perspective. I am not in regret after posting this. – prosti Oct 1 '16 at 23:18
  • Flexible/full/strict makes no difference to SEO, that setting is for connection to the origin server. Cloudflare presents a shared https certificate to whoever requests the page, how it connects to the origin is largely irrelevant. – Tim Oct 1 '16 at 23:54
  • Assuming the server does have a valid SSL cert (the OP doesn't specify, and I came here via an similar config google), this is a great option - note it can also be scoped to a particular subdomain via the Page Rules. – skoczen Oct 17 '17 at 3:46
  • This is a super good answer for me that had a valid SSL. – Philip Oct 23 '17 at 15:00

protected by Community Apr 20 '18 at 13:42

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.