2

I have multiple domains and multiple domains using SSL certs running under nginx. All domains are basically using the exact same config, substituting for names of course, except for the HTTPS-enabled domains which I have the SSL settings specified. Between these two domains the config is also the same for SSL with exception of file names for keys and such. Each website is also running on it's own dedicated IP. (all of them)

All my non-SSL sites are working just fine. I can access them without any problems. All my SSL sites get a 521 error from CloudFlare. (Strict SSL is on, just fyi)

One of the domains I had previously set up had been working just fine. Even if I remove the other SSL-enabled domain it still doesn't work now. The only config change I made was adding a new domain that was also using a SSL cert. When I test the config with nginx it says everything is fine. When I check netstat I can see those IPs in the listening over 443. I don't see any errors in /var/log/syslog or nginx's access and error logs.

Main nginx.conf

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

Example SSL site conf in /etc/nginx/conf.d

server {
    listen       [IPv6 address]:443;
    server_name  domain;
    ssl on;

    ssl_certificate      /etc/nginx/domain.crt;
    ssl_certificate_key  /etc/nginx/domain.key;

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout  5m;

    ssl_protocols TLSv1.2;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers   on;

    add_header Strict-Transport-Security max-age=31536000;

    #charset koi8-r;
    #access_log  /var/log/nginx/log/host.access.log  main;

    location / {
        root   /srv/domain/www;
        index  index.html index.htm index.php;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {
    #    root           html;
        fastcgi_pass   unix:/run/domain.sock;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /srv/domain/www$fastcgi_script_name;
        include        fastcgi_params;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #    deny  all;
    #}
}
  • 1
    Tip: show your config and demonstrate a problem - don't describe it. – AD7six Dec 25 '14 at 17:39
  • Check your domains against SSLLabs and look for problems like incomplete certificate chains. – Steffen Ullrich Dec 25 '14 at 19:17
  • Well one website had already been working with its SSL cert before things broke. I didn't change anything about the configuration for that site or the certificate either. The only change I had made in nginx was adding that additional site. – visionviper Dec 25 '14 at 19:49
1

Ok, so here's what the problem ended up being. I assumed that if you enabled Full SSL (Strict) that CloudFlare would always connect to your website over HTTPS. Obviously that's not how it works. If you try to visit a site using HTTP CloudFlare will still connect to your server over HTTP.

All I had to do was add a page rule on each domain to force the redirection to HTTPS.

So it wasn't nginx at all, it was just me being dumb.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.