0

I'm trying to configure nginx as reverse proxy (cache) for a website that runs Apache + Wordpress and that is configured to redirect all HTTP traffic to HTTPS. To this end I'm trying to disable the HTTPS redirection in Apache/Wordpress (origin server).

Let alone nginx, a working copy of the origin server (Apache) is at http://test.assodigitale.it:14580 and here is what I've done so far:

  1. Removed the "Redirect 301 https://..." from the virtual host
  2. Removed .htaccess
  3. Disabled all WP plugins
  4. Replaced in the database all https://test.assodigitale occurrences with http://test.assodigitale, including serialized Wordpress strings
  5. Disabled mod_http2
  6. Commented out Protocols h2 h2c http/1.1 from apache config
  7. Checked that no HSTS configuration is in place

However all I obtained is that the server replies plain HTTP only, but the redirection of the browser to HTTPS is still taking place and it causes the obvious SSL error you see by clicking the link above.

I'm overlooking something, but I don't understand what, and I don't know how to trace the communication between the browser and the server to pin down the guilty configuration. Can you help please?

EDIT AFTER COMMENTS:

I'm using Apache because I need it for reasons beyond the scope of this question. I know I could do everything with nginx only, but please ignore nginx while considering the problem. I've included it in my question only to give a context, but the problem is there regardless of nginx. It's Apache listening to port 14580 and it's Apache or something else after it redirecting the browser, not nginx that sits before Apache and that, by the way, at the moment is not even listening to port 80 (hence the connection refused when connecting to port 80 as reported by madeddie).

However madeddie reports also that the server redirects his browser to port 80, while in my case I got redirected to port 443, which makes me wonder how come the server is even issuing different redirects to me and to him...

  • Why are you running Apache here? It is not necessary. – Michael Hampton Aug 11 '16 at 8:26
  • Apache is not needed here. However, if you want to run it like this, you need to show the nginx configuration in order for us to find the error. – Tero Kilkanen Aug 11 '16 at 9:08
  • actually, i can't test your url, since test.assodigitale.it:14580 redirects to test.assodigitale.it and there's nothing listening on that machine on port 80 – madeddie Aug 11 '16 at 10:22
  • 2
    Did you check HSTS is not in place NOW, or that it has NEVER been? If your server previously issued HSTS and your browser accessed it during that time, the browser remembers HSTS and forces HTTPS (TLS) until the previously given HSTS max-age is reached. Did or can you try a non-browser client like curl -v or wget (or even jsoup)? Just in case there's some DNS weirdness is 138.201.87.117 the correct address? – dave_thompson_085 Aug 11 '16 at 21:58
  • @dave_thompson_085 you're right, curl -v shows something about HSTS, thanks for the tip. If you turn your comment into an answer I can accept it. – Lucio Crusca Aug 12 '16 at 6:15
0

As pointed out by dave_thompson_085 in a comment, the problem was HSTS being active in the past.

I don't remember how I solved it, but that was the cause of the problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.