0

I have this situation:

I have EV SSL and it's common name is abc.com

www.example.com is included on SAN's but not example.com

this is my vhost config:

server {
  listen 80;
  server_name example.com;
  return 301 https://www.example.com$request_uri;
}

server {
  listen 443 ssl http2 default_server;
  ssl_certificate /etc/ssl/example/combined.crt;
  ssl_certificate_key /etc/ssl/example/example.key;
  root /var/www/example;

  include snippets/ssl-params.conf;
  add_header X-Frame-Options SAMEORIGIN;

  location ~* \.(eot|ttf|woff)$ {
    add_header Access-Control-Allow-Origin *;
  }

  location / {
    index index.html index.php;
    try_files $uri $uri/ @handler;
    expires 30d; ## Assume all files are cachable
  }

  ## These locations would be hidden by .htaccess normally
  location ^~ /app/                { deny all; }
  location ^~ /includes/           { deny all; }
  location ^~ /lib/                { deny all; }
  location ^~ /media/downloadable/ { deny all; }
  location ^~ /pkginfo/            { deny all; }
  location ^~ /report/config.xml   { deny all; }
  location ^~ /var/                { deny all; }

  location /var/export/ { ## Allow admins only to view export folder
    auth_basic           "Restricted"; ## Message shown in login window
    auth_basic_user_file /root/htpasswd; ## See /etc/nginx/htpassword
    autoindex            on;
  }

  location  /. { ## Disable .htaccess and other hidden files
    return 404;
  }

  location @handler { ## Magento uses a common front handler
    rewrite / /index.php;
  }

  location ~ .php/ {
    rewrite ^(.*.php)/ $1 last;
  }

  location ~ .php$ { ## Execute PHP scripts
    if (!-e $request_filename) { rewrite / /index.php last; }
      #fastcgi_param MAGE_IS_DEVELOPER_MODE on;
      expires        off; ## Do not cache dynamic content
      fastcgi_pass unix:/run/php/php7.0-fpm.sock;
      fastcgi_param  HTTPS $fastcgi_https;
      fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
      fastcgi_param  MAGE_RUN_CODE default;
      fastcgi_param  MAGE_RUN_TYPE store;
      include        fastcgi_params; ## See /etc/nginx/fastcgi_params
  }
}

My issue is I can't seem to make it redirect from http://example.com to https://www.example.com

NOTE: when I try example.com on ssl checker it says

The hostname (example.com) does NOT match the Common Name in the certificate (abc.com). This certificate is currently invalid for this host.

3

3 Answers 3

1

Currently your config's redirect scheme is:

  1. http://example.com -> https://www.example.com/
  2. http://www.example.com -> https://www.example.com/

But the second part of your config seems to just catch all https connections?

Here's how i would do it though:

// this one is already correct.
// 1. http://example.com -> https://www.example.com/
// 2. http://www.example.com -> https://www.example.com/
server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://www.example.com$request_uri;
}

// redirect https non-www to www
// 3. https://example.com -> https://www.example.com
server {
  listen 443 ssl;
  server_name example.com;
  // IMPORTANT: SSL configs here, then
  // REDIRECT IN PLACE OF VHOST CONFIGS
  return 301 https://www.example.com$request_uri;
}

// 4. Serve explicit vhost https://www.example.com
server {
  listen 443 ssl;
  server_name www.example.com
  // IMPORTANT: SSL configs here
  // VHOST CONFIG HERE e.g: 
  location / {

  }
}

// Finally, all other unnamed requests should go to a 404.
server {
  listen 80 443 default;
  server_name _;
  return 404;
}

Also your comment about:

The hostname (example.com) does NOT match the Common Name in the certificate (abc.com). This certificate is currently invalid for this host.

This means you are redirecting/serving from a vhost that's not included in the certificate SAN. You need to have both the apex domain and the www subdomain in the certificate if you're redirecting from one to another under an SSL connection.

1
  • for the meantime as per Seth's suggestion, I used letsencrypt to redirect non-www to wwww.. and it works.. yay! I added the letsendcrypt configs on the 2nd server block Dec 22, 2016 at 16:44
0
server {
    listen 80;
    server_name example.com;
    return 301 $scheme://www.example.com$request_uri;
}

server {
    listen 80
    server_name www.example.com;
    <<< your vhost config>>>>>

     listen:443
     <<<< your ssl config >>>>>
}

Thats how i am doing that.

3
  • still says can't establish a secure connection to the server example.com Dec 21, 2016 at 15:04
  • does your .cert files correct? Could you establish connection with ssl without this redirect?
    – Yanik
    Dec 21, 2016 at 15:50
  • yes.. if I directly type www.example.com it will redirect to https://www.example.com with the EV SSL displaying on my address bar Dec 21, 2016 at 16:27
0

Then you may use https:// instead of $scheme.

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 443
    server_name www.example.com;

     <<<< your ssl config >>>>>

Not the answer you're looking for? Browse other questions tagged .