0

my default server config is :

# redirection http://example.org vers https//example.org
#
server {
    server_name example.org;
    return 301 https://example.org$request_uri;
}

# redirection http ou https www.example.org vers https ou https example.org
#
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
        include snippets/ssl-example.org.conf;
        include snippets/ssl-params.conf;

    server_name www.example.org;
    return 301 $scheme://example.org$request_uri;
}

#bloc server https://example.org
#
server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;

    include snippets/ssl-example.org.conf;
    include snippets/ssl-params.conf;

    server_name example.org;

    root /var/www/html;
    index index.html index.htm index.nginx-debian.html;

    location / {
        try_files $uri $uri/ =404;
    }

        location ~/.well-known {
            allow all;
        }
}

Accessing directly https://example.org or https://www.example.org is fine

BUT when I try http access http://example.org or http://www.example.org , I get

This page isn’t working
example.org didn’t send any data.
ERR_EMPTY_RESPONSE

I checked with curl

$ curl -Iv http://example.org
* Rebuilt URL to: http://example.org/
*   Trying 138.197.100.98...
* TCP_NODELAY set
* Connected to example.org (138.197.100.98) port 80 (#0)
> HEAD / HTTP/1.1
> Host: example.org
> User-Agent: curl/7.51.0
> Accept: */*

No 301 return

My ssl-params.conf file is :

# from https://cipherli.st/
# and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
 # Disable preloading HSTS for now.  You can use the commented out header line that includes
# the "preload" directive if you understand the implications.
 #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;

ssl_dhparam /etc/ssl/certs/dhparam.pem;

what's wrong with my config ? note: I am using AVAST anti-virus, Chrome Version 59.0.3071.115 (Official Build) (64-bit) or Safari Version 10.1.1 (12603.2.4).. same issue

0

I think you should add here 'listen' directive

server {
    server_name example.org;
    return 301 https://example.org$request_uri;
}

and replace '$scheme' for 'https' here(because if $scheme == http you redirected to http. Where is the sense?)

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
        include snippets/ssl-example.org.conf;
        include snippets/ssl-params.conf;

    server_name www.example.org;
    return 301 $scheme://example.org$request_uri;
}
  • thanks for your feedback . ... If I had a listen 80 iwithin the first block , I have a double definition (?) And the $scheme in the second block is only for www.example.org, this block is running fine... As only example.com is a problem I guess it's related to HSTS directive ... which may be blocking http requests... I'll check that – erwin Jul 14 '17 at 15:49
  • Exctly - commenting the HSTS directive in my ssl-params.conf file did it , it's now running fine with example.com – erwin Jul 14 '17 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.