8

After i add Let's Encrypt certificate to my website with CertBot i get ERR_TOO_MANY_REDIRECTS when i try to visit the domain of my website.

some info :

-mywebsite build with django, nginx and gunicorn.

server {
server_name www.example.com example.com;

location = /favicon.ico { access_log off; log_not_found off; }
location /static/ {
    root /home/myproject;
}

location / {
    include proxy_params;
    proxy_pass http://unix:/run/gunicorn.sock;
}


listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = www.example.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


if ($host = example.com) {
    return 301 https://$host$request_uri;
} # managed by Certbot

listen 80;
server_name www.example.com example.com;
return 404; # managed by Certbot

}

/etc/letsencrypt/options-ssl-nginx.conf :-

# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file.

ssl_session_cache shared:le_nginx_SSL:1m;
ssl_session_timeout 1440m;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;

ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RS$

please tell me if you need any other code/info thanks

Note : i have read all the questions with the same problem and i still can't know what is wrong

2 Answers 2

8

That's because you're redirecting all connections to https, even https connections, which means you create a redirect loop.

Change your config to

server {
    listen 80 default_server;
    server_name www.example.com example.com;

    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl default_server;
    server_name www.example.com example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


    location /favicon.ico { 
        access_log off; 
        log_not_found off; 
    }
    location /static/ {
        root /home/myproject;
    }

    location / {
        include proxy_params;
        proxy_pass http://unix:/run/gunicorn.sock;
    }
}

Though it would be good to know what your /etc/letsencrypt/options-ssl-nginx.conf includes.

Explanation:

Basically you need two "server" sections, one for port 80 and one for port 443. The port 80 (http) section only has the redirect in it and the 443 section holds the actual settings for your site (locations, roots, etc.) and the SSL settings (certificates, supported protocols, ciphers, etc.).

So when a client connects via http the server tells him to go to https instead and then the https part handles everything from there.

It's also a good idea to use indentation in your configs for better readability and easier bug fixing.

Note: The config I posted only fixed your redirect issue, I don't know if the actual config you had was valid for your case (gunicorn etc.). Normally you should also define an index and a root for your server like this:

root /home/website/mywebsite/public;
index index.html index.htm index.php;
10
  • thanks for your replay , i have update my question with the file you asked ... i get this problem when i update my config "/etc/nginx/sites-available/myproject" : Job for nginx.service failed because the control process exited with error code. See "systemctl status nginx.service" and "journalctl -xe" for details. when i run "systemctl status nginx.service" i get this nginx: [emerg] a duplicate default server for 0.0.0.0:80 in /etc/nginx/sites-enabled/myproject:3
    – DAMAR225
    Oct 1, 2018 at 0:01
  • when i open "/etc/nginx/sites-enabled/myproject" it has the same settings that i have add to "/etc/nginx/sites-available/myproject"
    – DAMAR225
    Oct 1, 2018 at 0:02
  • when i run "journalctl -xe" for details" i get this -- The start-up result is RESULT. error: Could not load host key: /etc/ssh/ssh_host_ecdsa_key: Did not receive identification string from 88.212.254.105 port 55487 -- Unit nginx.service has begun starting up. nginx: [emerg] a duplicate default server for 0.0.0.0:80 in /etc/nginx/sites-enabled/myproject:3 nginx: configuration file /etc/nginx/nginx.conf test failed nginx.service: Control process exited, code=exited status=1 nginx.service: Failed with result 'exit-code'. Failed to start A high performance web server and a reverse proxy server
    – DAMAR225
    Oct 1, 2018 at 0:03
  • Note : when i remove default_server from "listen 80 default_server;" nginx work but i still get the same probelm ERR_TOO_MANY_REDIRECTS
    – DAMAR225
    Oct 1, 2018 at 0:06
  • also i have change listen 80 default_server to listen 81 default_server it works but give me welcome to nginx
    – DAMAR225
    Oct 1, 2018 at 0:50
13

In case someone is using CloudFlare and having the same issue.

This fixed it: https://stackoverflow.com/a/60789055/3858492

In my case it was Cloudflare. I had to change to Full SSL encryption

2
  • 1
    indeed, full-encryption fixes redirect issues (using certbot/nginx/cloudflare/DO stack).
    – GG_Python
    Dec 29, 2020 at 0:40
  • After an upgrade to nginx 1.19 to 1.25 (docker). Feb 20 at 16:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .