3

I have a simple question. I'm just wondering if I have like:

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com;
    ...
}

Does this automatically redirect me from http to https if I enter URL http://example.com?

It works for me but I'm not really sure if it works for everyone, that's why I'm asking.

Thanks in advance.

  • No it doesn't, if it is "working" for you, then it isn't this bit of config that is doing it – Drifter104 Oct 4 '16 at 16:38
  • If you are using Strict-Transport-Security you may be seeing the client's browser redirecting from http to https automatically. – Richard Smith Oct 4 '16 at 17:41
  • Yeah, I am using this header: add_header Strict-Transport-Security max-age=15768000; Do I have to do a manual redirection in NGINX file if I have this? – GTX Oct 4 '16 at 17:55
  • @RichardSmith That still would require first connection on port 80, or getting the site on a preload list. Infact chrome require port 80 to 443 redirection to be present even for a preload submission – Drifter104 Oct 4 '16 at 19:19
  • @Drifter104 Are you sure? I am thinking that connecting to HTTPS with HSTS once makes the browser refuse to connect to HTTP (until max age expires). I have no experience of chrome though. Oh and I wasn't suggesting that HSTS is an answer, just an explanation for the questioner's observations. – Richard Smith Oct 4 '16 at 19:47
8

No, typically need something like this to do the forwarding.

If it's working already something else could be doing it. Are there any other web servers install? Are you using a CDN that might be doing it?

server {
  server_name example.com;
  listen 443 ssl http2;
  // etc - main server
}   


# Forward non-www requests to www
server {
  listen       80;
  server_name  example.com www.example.com;
  access_log  /var/log/nginx/access.log main buffer=128k flush=1m if=$log_ua;
  return       301 https://www.example.com$request_uri;
}

server {
  listen 443 ssl http2;
  server_name www.example.com;

  ssl_certificate /var/lib/acme/certs/***CERT_DIRECTORY/fullchain;
  ssl_certificate_key /var/lib/acme/certs/***CERT_DIRECTORY/privkey;

  # Set up preferred protocols and ciphers. TLS1.2 is required for HTTP/2
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

  access_log  /var/log/nginx/access.log main buffer=128k flush=1m if=$log_ua;

  return 301 https://www.example.com$request_uri;
}
  • Thanks for the code! I'm currently using this for redirection: server { listen 80 default_server; listen [::]:80 default_server; server_name example.com www.example.com sub1.example.com sub2.example.comt; return 301 https://$host$request_uri; } I'm not redirecting non-www to www. Is my code good? – GTX Oct 5 '16 at 15:37
  • It looks about right to me. If it works it's good, if it doesn't then look more carefully at the example I posted above. – Tim Oct 5 '16 at 17:58
  • Hey, @Tim I'm sorry for being late, but I'd like to ask: – GTX Oct 21 '16 at 8:04
  • I'm using *.example.com for domain record, and when using that example code I posted, when I visit non-existing domain it shows that certificate is invalid, how can I fix that? Sorry for double comment by the way.. – GTX Oct 21 '16 at 8:06

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.