SSL http and https

Francisco Esteves · Sep 4, 2014

Hello,
About Nginx HTTPS / SSL Google SPDY configuration

This how to appers to be the only site with SSL and redirect http to https right?
My client need http and https works (only want use ssl in a few pages). How to make this configuration right?

Thanks,

eva2000 · Sep 4, 2014

yeah the config outlined in that link is for http redirect to https only

For http and https, you'd need to remove the redirect and have listen 80 port along with listen 443 spdy ssl in same server context for your domain VHOST

so remove
Code:
server {
  server_name domain.com www.domain.com;
  return 301 https://$server_name$request_uri;
}
and use
Code:
server {
        listen 80;
        listen 443 ssl spdy;
            server_name domain.com;

Francisco Esteves · Sep 7, 2014

Hello,
Thanks for help but have a new problem.

When try enter in a http page all runs fine. When open a https page and then try open again a http page the page redirects do https and cant access again http page. Its not related to scripts or browser cache.

Any idea?

Have see this in headers of http page

alternate: :443:npn-spdy/3

Using Google as example in http alternate is port 80.

eva2000 · Sep 7, 2014

sounds like still browser cache from previous http to https 301 permanent redirects as they are cached into browser

you can try a totally different browser and check to see if it is the case

Francisco Esteves · Sep 7, 2014

Hello,
Its not related to browser.

In clean browser i can access http. When access https i cant open again http because browser redirect to https.
Can i send the url via pm for you to check?

eva2000 · Sep 7, 2014

yeah pm me the domain

but post contents of your nginx vhost conf file here masking domain name

eva2000 · Sep 7, 2014

got pm,

works fine for me in IE11

going http works
going https works
going back to http works

you probably didn't clear your browser cache properly, cache and browser history needs clearing and closing browser..

you'd have to google search for proper ways to clear browser of 301 permanent redirects

try a different browser altogether to confirm

Francisco Esteves · Sep 7, 2014

Hello,
# https SSL SPDY vhost
server {
listen 80;
listen 443 ssl spdy;
server_name xxxx.net www.xxxx.net;

ssl_certificate /usr/local/nginx/conf/ssl/xxxx.net/ssl-unified.crt;
ssl_certificate_key /usr/local/nginx/conf/ssl/xxxx.net/ssl.key;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384HE-RSA-AES128-GCM-SHA256HE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHAHE-RSA-AES128-SHA256HE-RSA-AES128-SHAHE-DSS-AES128-SHA256HE-RSA-AES256-SHA256HE-DSS-AES256-SHAHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!kEDH:!EDH:!CAMELLIA;
ssl_prefer_server_ciphers on;
add_header Alternate-Protocol 443:npn-spdy/3;
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

# enable ocsp stapling
resolver 8.8.8.8;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /usr/local/nginx/conf/ssl/xxxx.net/ssl-trusted.crt;

access_log /home/nginx/domains/xxxx.net/log/access.log combined buffer=32k;
error_log /home/nginx/domains/xxxx.net/log/error.log;
root /home/nginx/domains/xxxx.net/public;

# ngx_pagespeed & ngx_pagespeed handler
include /usr/local/nginx/conf/pagespeed.conf;
include /usr/local/nginx/conf/pagespeedhandler.conf;
include /usr/local/nginx/conf/pagespeedstatslog.conf;

error_page 404 /index.php?controller=404;

# PrestaShop rewrites
rewrite "^/pt/" /$1 last;
rewrite "^/es/" /$1 last;
rewrite "^/en/" /$1 last;
rewrite "^/fr/" /$1 last;
rewrite "^/it/" /$1 last;

rewrite ^/([a-z0-9]+)\-([a-z0-9]+)(\-[_a-zA-Z0-9-]*)/[_a-zA-Z0-9-]*\.jpg$ /img/p/$1-$2$3.jpg last;
rewrite ^/([0-9]+)\-([0-9]+)/[_a-zA-Z0-9-]*\.jpg$ /img/p/$1-$2.jpg last;
rewrite ^/([0-9])(\-[_a-zA-Z0-9-]*)?/[_a-zA-Z0-9-]*\.jpg$ /img/p/$1/$1$2.jpg last;
rewrite ^/([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?/[_a-zA-Z0-9-]*\.jpg$ /img/p/$1/$2/$1$2$3.jpg last;
rewrite ^/([0-9])([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?/[_a-zA-Z0-9-]*\.jpg$ /img/p/$1/$2/$3/$1$2$3$4.jpg last;
rewrite ^/([0-9])([0-9])([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?/[_a-zA-Z0-9-]*\.jpg$ /img/p/$1/$2/$3/$4/$1$2$3$4$5.jpg last;
rewrite ^/([0-9])([0-9])([0-9])([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?/[_a-zA-Z0-9-]*\.jpg$ /img/p/$1/$2/$3/$4/$5/$1$2$3$4$5$6.jpg last;
rewrite ^/([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?/[_a-zA-Z0-9-]*\.jpg$ /img/p/$1/$2/$3/$4/$5/$6/$1$2$3$4$5$6$7.jpg last;
rewrite ^/([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?/[_a-zA-Z0-9-]*\.jpg$ /img/p/$1/$2/$3/$4/$5/$6/$7/$1$2$3$4$5$6$7$8.jpg last;
rewrite ^/([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?/[_a-zA-Z0-9-]*\.jpg$ /img/p/$1/$2/$3/$4/$5/$6/$7/$8/$1$2$3$4$5$6$7$8$9.jpg last;
rewrite ^/c/([0-9]+)(\-[_a-zA-Z0-9-]*)/[_a-zA-Z0-9-]*\.jpg$ /img/c/$1$2.jpg last;
rewrite ^/c/([a-zA-Z-]+)/[a-zA-Z0-9-]+\.jpg$ /img/c/$1.jpg last;
rewrite ^/([0-9]+)(\-[_a-zA-Z0-9-]*)/[_a-zA-Z0-9-]*\.jpg$ /img/c/$1$2.jpg last;
rewrite ^/([0-9]+)\-[a-zA-Z0-9-]*\.html /product.php?id_product=$1 last;
rewrite ^/[a-zA-Z0-9-]*/([0-9]+)\-[a-zA-Z0-9-]*\.html /product.php?id_product=$1 last;
rewrite ^/([0-9]+)\-[a-zA-Z0-9-]*(/[a-zA-Z0-9-]*)+ /category.php?id_category=$1&noredirect=1 last;
rewrite ^/([0-9]+)\-[a-zA-Z0-9-]* /category.php?id_category=$1 last;
rewrite ^/([0-9]+)__([a-zA-Z0-9-]*) /supplier.php?id_supplier=$1 last;
#rewrite ^/([0-9]+)_([a-zA-Z0-9-]*) /manufacturer.php?id_manufacturer=$1 last;

rewrite ^/content/([0-9]+)\-([a-zA-Z0-9-]*) /cms.php?id_cms=$1 last;
rewrite ^/content/category/([0-9]+)\-([a-zA-Z0-9-]*) /cms.php?id_cms_category=$1 last;
rewrite ^/page-not-found$ /404.php last;
rewrite ^/address$ /address.php last;
rewrite ^/addresses$ /addresses.php last;
rewrite ^/authentication$ /authentication.php last;
rewrite ^/best-sales$ /best-sales.php last;
rewrite ^/cart$ /cart.php last;
rewrite ^/contact-us$ /contact-form.php last;
rewrite ^/discount$ /discount.php last;
rewrite ^/guest-tracking$ /guest-tracking.php last;
rewrite ^/order-history$ /history.php last;
rewrite ^/identity$ /identity.php last;
rewrite ^/manufacturers$ /manufacturer.php last;
rewrite ^/my-account$ /my-account.php last;
rewrite ^/new-products$ /new-products.php last;
rewrite ^/order$ /order.php last;
rewrite ^/order-follow$ /order-follow.php last;
rewrite ^/quick-order$ /order-opc.php last;
rewrite ^/order-slip$ /order-slip.php last;
rewrite ^/password-recovery$ /password.php last;
rewrite ^/prices-drop$ /prices-drop.php last;
rewrite ^/search$ /search.php last;
rewrite ^/sitemap$ /sitemap.php last;
rewrite ^/stores$ /stores.php last;
rewrite ^/supplier$ /supplier.php last;

#COMPRESS
location ~* .(gif|jpg|jpeg|png)$ {
expires 3M;
add_header Pragma public;
add_header Cache-Control "max-age=7776000, public";
add_header Access-Control-Allow-Origin *;
}
location ~* .(ico)$ {
expires 1y;
add_header Pragma public;
add_header Cache-Control "max-age=31536000, public";
add_header Access-Control-Allow-Origin *;
}
location ~* .(mp4)$ {
expires 1y;
add_header Pragma public;
add_header Cache-Control "max-age=31536000, public";
add_header Access-Control-Allow-Origin *;
}
location ~* .(woff|otf|eot|ttf)$ {
expires 1y;
add_header Pragma public;
add_header Cache-Control "max-age=31536000, public";
add_header Access-Control-Allow-Origin *;
}
location ~* .(css|js|jsonp)$ {
expires 1M;
add_header Pragma public;
add_header Cache-Control "max-age=2592000, public";
add_header Access-Control-Allow-Origin *;
}

location ~* .(dat)$ {
expires 1y;
add_header Pragma public;
add_header Cache-Control "max-age=31536000, public";
add_header Access-Control-Allow-Origin *;
}
#Dont Index Sitemap
location ~* ^.+.(xml|xml.gz)$ {
add_header X-Robots-Tag "noindex";
}

#Disallow TPL
location ~* .(tpl)$ {
deny all;
}
include /usr/local/nginx/conf/staticfiles.conf;
include /usr/local/nginx/conf/php.conf;
include /usr/local/nginx/conf/drop.conf;
#include /usr/local/nginx/conf/errorpage.conf;
}

eva2000 · Sep 7, 2014

better to use [CODE][/CODE] tags for the vhost contents

but nothing in the Nginx vhost I see can cause that other than your browser's caching the 301 permanent redirects.

you'd have to google search for proper ways to clear browser of 301 permanent redirects

ie. masking yourdomain.com

working no 301 redirects
Code:
curl -I http://www.yourdomain.com/isaque.php
HTTP/1.1 200 OK
Server: nginx centminmod
Date: Sun, 07 Sep 2014 12:25:11 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Vary: Accept-Encoding
Alternate-Protocol: 443:npn-spdy/3
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Code:
curl -I https://www.yourdomain.com/isaque.php
HTTP/1.1 200 OK
Server: nginx centminmod
Date: Sun, 07 Sep 2014 12:25:20 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Vary: Accept-Encoding
Alternate-Protocol: 443:npn-spdy/3
Strict-Transport-Security: max-age=31536000; includeSubdomains;

Francisco Esteves · Sep 7, 2014

Hello,
Very stange because we never access the site with my smartphone because is new..
But alternate protocol is correct?

Example for Google:

google.pt:80 -> alternate google.pt:80:quic
google.com:443 -> alternate google.com:443:quic

eva2000 · Sep 7, 2014

yes correct, it tells browser that server supports SPDY/3.1 SSL and should use it
Code:
Alternate-Protocol: 443:npn-spdy/3
@Tracy Perry is currently working on a forum with http to https 301 redirect cached in browser too and it's working for me when he has temp removed https to http. Maybe he has more tips for proper browser cache clearing ?

google search has alot on it too Let me google that for you

oh some things to try web development - How can I make Chrome stop caching redirects? - Super User

If you have the "Disable cache (while DevTools is open)" option enabled in the DevTools, then simply having the DevTools open is enough to bypass the redirect cache, without constantly throwing away your session.
Click to expand...

To clear the redirect cache for a single page in Chrome, View Source and do a hard refresh (CTRL + SHIFT + R).

This works as the source browser doesn't automatically follow the 301 redirects.
Click to expand...

In either Chrome or Firefox, you can refresh the redirect by typing "view-source:redirect.yoursite.com" and hitting enter. Then, refresh that page. Now, that should force Chrome or Firefox to refresh the redirect.
Click to expand...

Francisco Esteves · Sep 8, 2014

Maybe find the problem?

Strict-Transport-Security Supporteded

Excellent! This website is using HSTS, also known as Strict Transport Security. This tells the browser to always use SSL when talking to this website, allows more of your visitors the opportunity to both be secure and to use SPDY. The server is sending the header Strict-Transport-Security: max-age=31536000; includeSubdomains; which tells the web browser to always use SSL to access this website for the next 365 days.
Code:
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
Try remove this?

eva2000 · Sep 8, 2014

yes you might want to remove it or instead create 2 separate server {} contexts on for listen 80 and one for listen 443 spdy ssl in the same Nginx vhost file

Francisco Esteves · Sep 8, 2014

Removing Strict-Transport-Security have any benefict using two server{}?

eva2000 · Sep 8, 2014

Francisco Esteves said: ↑

Removing Strict-Transport-Security have any benefict using two server{}?
Click to expand...

only need to remove it from non-https server {} if you separate the server {} contexts on for listen 80 and one for listen 443 spdy ssl in the same Nginx vhost file

Tracy Perry · Sep 9, 2014

For xenadmins.com, here is the vhost I was using

Code:

server {
    listen   80;
    server_name xenadmins.com;
    return 301 http://$server_name$request_uri;
        }
server {
        server_name xenadmins.com;
#        listen   443 ssl spdy;
#        ssl on;
#        ssl_certificate     /usr/local/nginx/conf/ssl/ssl-bundle.crt;
#        ssl_certificate_key /usr/local/nginx/conf/ssl/xenadmins_com.key;
 #       ssl_ciphers #ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;
#        add_header Alternate-Protocol 443:npn-spdy/3;
#        ssl_protocols   SSLv3 TLSv1 TLSv1.1 TLSv1.2;
#        ssl_prefer_server_ciphers   on;
#        ssl_session_cache    shared:SSL:10m;
#        ssl_session_timeout  10m;
#        add_header X-Content-Type-Options "nosniff";
#        add_header X-Frame-Options SAMEORIGIN;
#        spdy_headers_comp 5;
#        ssl_buffer_size 4k;
#        ssl_session_tickets on;
#        ssl_stapling_verify on;
#        ssl_stapling on;
#        ssl_trusted_certificate /usr/local/nginx/conf/ssl/ssl-bundle.crt;
#        resolver 8.8.8.8 8.8.4.4 valid=10m;
#        resolver_timeout 10s;
#        add_header Strict-Transport-Security max-age=31536000;
#        add_header X-Cache $upstream_cache_status;
#        spdy_keepalive_timeout 180s; # inactivity timeout after which the SPDY connection is closed
 #       spdy_recv_timeout        4s; # timeout if nginx is currently expecting data from the client but nothing arrives

# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

  # limit_conn limit_per_ip 16;
#  ssi  on;

  access_log /home/nginx/domains/xenadmins.com/log/access.log combined buffer=32k;
  error_log /home/nginx/domains/xenadmins.com/log/error.log;

  root /home/nginx/domains/xenadmins.com/public;

location /nginx_status {
                stub_status on;
                access_log   off;
                allow 127.0.0.1;
                allow 204.44.114.103;
                allow 64.188.254.247;
                deny all;
    }


  location / {

        index index.php index.html index.htm;
        try_files $uri $uri/ /index.php?$uri&$args;
    location /internal_data/ {
            internal;
            allow 127.0.0.1;
            deny all;
            }
    location /library/ {
            internal;
            allow 127.0.0.1;
            deny all;
            }
        
        
            location /monitorix {
                    auth_basic "Restricted";
                    auth_basic_user_file /etc/monitorix/monitorix-users;
                    include /usr/local/nginx/conf/proxy.conf;
                    proxy_pass          http://localhost:8080/monitorix;
                    allow               127.0.0.0/8;
                    # for old versions up to 3.4.0
                    #    location ~* \.png$ {
                    #       root /usr/share;
                        }
                    # since 3.5.0 version
            location ~ ^/monitorix/(.+\.png)$ {
                    alias /var/lib/monitorix/www/$1;
            }
        
        
# block common exploits, sql injections etc
#include /usr/local/nginx/conf/block.conf;
  }

  include /usr/local/nginx/conf/staticfiles.conf;
  include /usr/local/nginx/conf/php.conf;
  include /usr/local/nginx/conf/drop.conf;
  #include /usr/local/nginx/conf/errorpage.conf;
}

Log in / Register

Forums

Join the community today

SSL http and https

Francisco Esteves New Member

eva2000 Administrator Staff Member

Francisco Esteves New Member

eva2000 Administrator Staff Member

Francisco Esteves New Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Francisco Esteves New Member

eva2000 Administrator Staff Member

Francisco Esteves New Member

eva2000 Administrator Staff Member

Francisco Esteves New Member

eva2000 Administrator Staff Member

Francisco Esteves New Member

eva2000 Administrator Staff Member

Tracy Perry Active Member

.

Log in / Register

Useful Searches

Join the community today

SSL http and https

Francisco Esteves New Member

eva2000 Administrator Staff Member

Francisco Esteves New Member

eva2000 Administrator Staff Member

Francisco Esteves New Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Francisco Esteves New Member

eva2000 Administrator Staff Member

Francisco Esteves New Member

eva2000 Administrator Staff Member

Francisco Esteves New Member

eva2000 Administrator Staff Member

Francisco Esteves New Member

eva2000 Administrator Staff Member

Tracy Perry Active Member

.