CDN Cloudflare Cloudflare Flexible SSL, Nginx & XenForo

The Nginx http to https redirect is same as mentioned at Nginx HTTPS / SSL Google SPDY configuration

Update 2 - October 17th, 2014: took 2+ weeks for Cloudflare to activate my FlexibleSSL domain. For http to https redirect, need 2 page rules

• http://domain.com/* forward via 301 or 302 to http://domain.com/$1
• http://www.domain.com/* forward via 301 or 302 to http://www.domain.com/$1

Update: actually this might be incorrect - re-reading Cloudflare's guide you need to redirect based on their custom CF-Visitor header being scheme:http only. Looking into this. Cloudflare tech support confirmed what I recommended was correct for Nginx http to https redirects.

Code:

server {
  server_name domain.com www.domain.com;
  return 301 https://$server_name$request_uri;
}

• As to seeing the real ip, really depends on whether Xenforo is the only web app on the server as that Xenforo work around at How do I restore original visitor IP with XenForo? – CloudFlare Support would only take care of Xenforo. If you have other web apps on same server under same Cloudflare protected domain, those web apps won't see the real ip. And yes as per Cloudflare and their new SSL for free users | XenForo Community it's isn't a good solution
• For all web apps under same Cloudflare protected domain to see the real IP, you don't need to do Xenforo workaround at How do I restore original visitor IP with XenForo? – CloudFlare Support but instead do what is listed at Nginx Cloudflare, Incapsula & PageSpeed Service Configuration (reverse proxy HttpRealIpModule) which is actually Cloudflare's recommended method as outlined at Does CloudFlare have an IP module for Nginx? – CloudFlare Support
• Added guide for Cloudflare FULL SSL option and using self signed SSL certificates at SSL - Creating your own self signed SPDY/3.1 SSL certificates | Centmin Mod Community

 

it takes Cloudflare at least 24-48+ hours for SSL to work, so for that time you will have invalid ssl certicate, so I wouldn't do the redirect in nginx until https is working.

 

make sure it's working the SSL certificate by checking in browser and clicking the padlock to make sure it doesn't say invalid, unprotected or does not match url messages

 

Update: the above listed 301 redirect for http to https maybe incorrect - re-reading Cloudflare's guide you need to redirect based on their custom CF-Visitor header being scheme:http only ?. Cloudflare tech support confirmed what I recommended was correct for Nginx http to https redirects.

There might be another way using Cloudflare's Page Rules - free plans get 3 page rules. More info on Cloudflare Page Rules. You will need to use 2 of them:

1. First page rule, for a http domain redirect to https
2. Second page rule, for wildcard match for domain.com/* to https://domain.com/$1. I can not confirm if this works yet as my Cloudflare Flexible SSL enabled domain isn't activated/working yet.

hmm looks like page rules only work for https redirect for non-free Cloudflare paid Pro plans according to Cloudlfare support

 

Yeah mine on free plan still hasn't be actived either. Clearly, they're overwhelmed with the Universal SSL activations right now heh.

Also updated my reply above as Cloudflare tech support confirmed what I recommended was correct for Nginx http to https redirects

 

mine says SSL issuing status heh

 

I can imagine, I'm just doing Cloudflare Flexible SSL tests on a test domain project I have on Cloudflare so no real visitor traffic right now so not as urgent

 

looks good on my end in my browser.. maybe clear browser cache and restart browser ?