0

I’m using nginx on ubuntu, and I have a problem, I have multiple domains in my ssl certificate(Let's Encrypt), when I access my website with the .com.br domain the users are forced to use the https, but the same does not happen with the other domains.

If I enable this line, all domains redirect to the domain .com.br:

return 301 https://www.$server_name$request_uri;

How can I fix this?

Here is my nginx config file:

server {
        listen 80 default_server;
        listen [::]:80 default_server ipv6only=on;

        client_max_body_size 100M;

        root /var/www/robbu.com.br/public;
        index index.php index.html index.htm;

        # Make site accessible from http://localhost/
        server_name domain.com.br www.domain.com.br domain.com.ar www.domain.com.ar domain.global www.domain.global domain.net www.domain.net domain.solutions www.$

        #return 301 https://www.$server_name$request_uri;

        location / {
                # First attempt to serve request as file, then
                # as directory, then fall back to displaying a 404.
                try_files $uri $uri/ /index.php?$query_string;
                # Uncomment to enable naxsi on this location
                # include /etc/nginx/naxsi.rules
        }
        location ~ \.php$ {
                try_files $uri =404;
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
                fastcgi_index index.php;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                include fastcgi_params;
        }

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/robbu.com.br/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/robbu.com.br/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
1

You need to create a server block for every domain you want forwarded to its own https domain. Repeat this set of two servers for each domain.

# This server simply redirects the requested to the https version of the page
server {
  listen 80;
  server_name www.example.com example.com;

  # Let's Encrypt certificates with Acmetool. Not sure if required on http or https (you can't connect to https server before there's a certificate) so do both.
  location /.well-known/acme-challenge/ {
    alias /var/www/.well-known/acme-challenge/;
  }

  location / {
    return 301 https://www.example.com$request_uri;
  }
}

server {
  listen 443 ssl http2;
  server_name example.com;

  ssl_certificate /var/lib/acme/certs/***CERT_DIRECTORY/fullchain;
  ssl_certificate_key /var/lib/acme/certs/***CERT_DIRECTORY/privkey;

  # Set up preferred protocols and ciphers. TLS1.2 is required for HTTP/2
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
  ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0

  access_log  /var/log/nginx/access.log main buffer=32k flush=1m if=$log_ua;

  return 301 https://www.example.com$request_uri;
}
  • Is this really necessary all this? An user in the Let's Encrypt Community suggest me to use: return 301 https://$http_host$request_uri; I have not tested it yet because I'm not at home... community.letsencrypt.org/t/… – Caio Kawasaki Mar 23 '18 at 23:05
  • 3
    @CaioKawasaki You should not attempt to listen on port 80 and 443 in the same server block to handle both http and https. While it sort of works, this configuration leads to a bunch of inefficient locations and other garbage. See these working sample configurations. – Michael Hampton Mar 23 '18 at 23:13
  • Yes, it's necessary if you want your server to work as you've described, and efficiently. – Tim Mar 23 '18 at 23:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.