0

I have redirected all https requests to http. Here you can see what I have done in the nginx config file:

*

#redirecting https to http:: 
server {    listen 443 ssl;    
listen [::]:443 ssl;
    server_name example.com www.example.com
        ssl_certificate /etc/nginx/sd.crt;
        ssl_certificate_key /etc/nginx/sd.key;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
         rewrite ^(.*)  http://www.example.com$1 permanent; }
#redirecting non-www to www::
server {
        listen 80;
       listen [::]:80;
        server_name example.com;    return       301 http://www.example.com$request_uri; }
#server block
server {
        listen 80;
       listen [::]:80;
        server_name www.example.com;

*

So the problem is that users get a Redirect Error, because the browser thinks that my website is still available under https. If I delete the cache I can access to my website, but how I can avoid this Redirect Error, most users think that my site is offline. And the cache will be deleted automatically after a few days... too long!

  • 4
    Why would you want to forward https traffic to http? Please read up on https everywhere and make sure you really mean to do this: eff.org/https-everywhere/faq – Jeff Jan 14 '16 at 23:27
  • I used https previously and I want to redirect Google and my users to my http site instead of getting a error when they surf on the previous http site. – fkin Jan 15 '16 at 17:07
  • When you "Redirect Error", what the exact HTTP response that the server is returning? – Mark Stosberg Jan 15 '16 at 17:30
0

The recommended solution is to purchase or renew the related SSL certificate and get your site back online under HTTPS.

The caching you describing sounds like it might be HSTS caching, although you didn't mention using that.

If that was the issue, you could disable the HSTS caching by adding this code into your nginx config file:

 add_header Strict-Transport-Security max-age=0;
  • 1
    Are you sure about the max-age value to disable HSTS? – gf_ Jan 15 '16 at 17:49
  • 2
    Thank you! add_header Strict-Transport-Security max-age=0; worked! The problem is my advertising network does not offer https, it's not a certificate problem! – fkin Jan 15 '16 at 18:16
  • 1
    @fkin Sorry, you were correct that it should have been "max-age=0". Thanks cor correcting that for me! – Mark Stosberg Jan 15 '16 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.