Nginx nginx not starting "unknown server_https variable"

neverminder · Dec 10, 2017

Solved the phpmyadmin install part. I removed /usr/local/nginx/conf/conf.d/phpmyadmin_ssl.conf.bak. I'll get back with the rest of the issues in a few minutes.

neverminder · Dec 10, 2017

phpmyadmin installed without errors, but trying to access it generates ERR_TOO_MANY_REDIRECTS.

eva2000 · Dec 10, 2017

What do you get for output for curl header checks in SSH where domain.com is yourdomain.com
Code (Text):
curl -I http://domain.com
Code (Text):
curl -I http://www.domain.com
Code (Text):
curl -I https://domain.com
Code (Text):
curl -I https://www.domain.com
If the problematic version(s) you are trying to get has a 301 HTTP status then it's probably a browser cached 301 permanent redirect issue.

If you use chrome in private incognito browsing session you probably have working www domain access ? if so you need to clear you browser of the 301 permanent redirect. If that works you need to clear your browsers' cache as outlined at Refreshyourcache.com - The Guide to Clear your Browser Cache!

That is dangers of 301 permanent redirects as they are cached in web browsers forever until cleared. 302 temp redirects are not permanent.

eva2000 · Dec 10, 2017

if you have cloudflare https enabled you can set http to https redirect on cloudflare level but remove the http to https redirect on nginx level - otherwise = too many redirects

neverminder · Dec 10, 2017

The only 301 redirects are for http://www and https:/www
Right now, my problem is that I can't access phpmyadmin page because of too many redirects. I didnt set up cloudflare to redirect http to https yet.

neverminder · Dec 10, 2017

On the other hand, trying the same on web.mszp.ro i'm getting this:

Code (Text):

# curl -I https://web.mszp.ro
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

neverminder · Dec 10, 2017

Just saw that all the lines in the ssl.conf file are commented out. I really couldn't tell if I did this, in all that panic when my site went down, as I didn't log anything like that (and I log quite every move).

eva2000 · Dec 10, 2017

neverminder said: ↑

The only 301 redirects are for http://www and https:/www
Right now, my problem is that I can't access phpmyadmin page because of too many redirects. I didnt set up cloudflare to redirect http to https yet.
Click to expand...

did you enable HSTS on Cloudflare or nginx ? that forces the entire domain and subdomains accessed to be forced over HTTPS as preemptive security measure

Are the host.domain.com and HTTPS enabled site also on same top level domain.com ? did you enable HSTS with include subdomain too ? if you did then you're telling browsers to force HTTP to HTTPS redirected connections for domain.com and any *.domain.com subdomain as well

see Enabling HSTS for SSL for specifics
Enabling HSTS For SSL
HTTP Strict Transport Security (HSTS) header for Nginx SSL is only used for SSL certificates HTTPS based web sites if you want to force redirect all non-HTTPS (HTTP) traffic to HTTPS version of the site for a sepcific max-age time ins econds. HSTS header is disabled and commented out by default as some folks don't realise that it can mess up your site for HTTP traffic if you want to be able to use your site on both HTTP and HTTPS versions.

if SSL certificate covers subdomains
Code (Text):
  #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
if SSL certificate DOES NOT cover subdomains
Code (Text):
  #add_header Strict-Transport-Security "max-age=31536000;";
To enable HSTS header, uncomment and remove hash # in front of either above lines.
Click to expand...
As accessing host.domain.com is usually reserved for stats and admin pages the Centmin Mod LEMP stack owner only needs to access, you can just clear your web browser's HSTS record for the domain.com and host.domain.com so the web browser no longer redirects from HTTP to HTTPS. I posted a thread at SSL - How to clear HSTS browser cache | Centmin Mod Community specifically for this
neverminder said: ↑
On the other hand, trying the same on web.mszp.ro i'm getting this:
Code (Text):
# curl -I https://web.mszp.ro
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
Click to expand...
is web.mszp.ro your main hostname ? if so, could be as above cloudflare HSTS is enabled

neverminder · Dec 10, 2017

I didnt enable HSTS. I cleared my web browser's HSTS record, I even turned off SSL in Cloudflare. phpmyadmin page still has too many redirections.

Yes, web.mszp.ro is my main hostname, but, as I said, HSTS is out of the question.

eva2000 · Dec 10, 2017

http://web.mszp.ro works for header check at https://tools.keycdn.com/curl

Code (Text):

HTTP/1.1 200 OK
Date: Sun, 10 Dec 2017 00:12:26 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Set-Cookie: __cfduid=d12d120263dee09efb5ca374effc40e361512864746; expires=Mon, 10-Dec-18 00:12:26 GMT; path=/; domain=.mszp.ro; HttpOnly
Last-Modified: Sat, 09 Dec 2017 21:29:12 GMT
Vary: Accept-Encoding
Expires: Mon, 11 Dec 2017 00:12:26 GMT
Cache-Control: max-age=86400
Cache-Control: public, must-revalidate, proxy-revalidate
Server: cloudflare-nginx
CF-RAY: 3cabfe16e55599ec-EWR

so the redirect is your web browser 301 cache probably (separate from HSTS cache)

neverminder · Dec 10, 2017

Yes, but for the phpmyadmin page it doesn't work:

Code (Text):

HTTP/1.1 301 Moved Permanently
Date: Sun, 10 Dec 2017 00:16:57 GMT
Content-Type: text/html
Connection: keep-alive
Set-Cookie: __cfduid=dd0abcf77a045f420a2f30835ade2121a1512865016; expires=Mon, 10-Dec-18 00:16:56 GMT; path=/; domain=.mszp.ro; HttpOnly
Location: https://web.mszp.ro/XXXXX_mysqladminXXXXX/
Server: cloudflare-nginx
CF-RAY: 3cac04b4061c218c-EWR

neverminder · Dec 10, 2017

In fact, I think this shows the problem:
Same query, but for https://web.mszp.ro/XXXXX_mysqladminXXXXX/

Code (Text):

HTTP/2 301
date: Sun, 10 Dec 2017 00:34:30 GMT
content-type: text/html
set-cookie: __cfduid=d5e826a1e71daadecc840d92a346034a71512866070; expires=Mon, 10-Dec-18 00:34:30 GMT; path=/; domain=.mszp.ro; HttpOnly
location: https://web.mszp.ro/XXXXX_mysqladminXXXXX/
server: cloudflare-nginx
cf-ray: 3cac1e6dca1791a6-EWR

eva2000 · Dec 10, 2017

you have cloudflare orange cloud enabled on the hostname web.mszp.ro that's why

neverminder · Dec 10, 2017

OK, I'm going to access it through the server's IP. That way is working. Back to the original problem, I'll keep the fastcgi_param HTTPS $server_https; line commented out in php-wpsc.conf for now. Hopefully, it won't be the source of more problems. Still don't know when and what happened. Are you sure it had nothing to do with me removing /etc/centminmod/php.d/mongodb.ini and /etc/centminmod/php.d/redis.ini? This is the only thing I did besides installing phpmyadmin.

Thanks for all your help so far!

neverminder · Dec 10, 2017

Well, if I try to activate full SSL on Cloudflare, accessing http://mszp[dot]ro (vhost) redirects me to https://web.mszp[dot]ro (mainhost).
If I change my wp and site URLs to https in wp admin, trying to access the site ends up in too many redirects.

I'm perfectly stuck. I don't understand anything anymore

eva2000 · Dec 11, 2017

neverminder said: ↑

Are you sure it had nothing to do with me removing /etc/centminmod/php.d/mongodb.ini and /etc/centminmod/php.d/redis.ini? This is the only thing I did besides installing phpmyadmin.
Click to expand...

yup sure nothing to do with those ini settings files

neverminder said: ↑

Well, if I try to activate full SSL on Cloudflare, accessing http://mszp[dot]ro (vhost) redirects me to https://web.mszp[dot]ro (mainhost).
If I change my wp and site URLs to https in wp admin, trying to access the site ends up in too many redirects.

I'm perfectly stuck. I don't understand anything anymore
Click to expand...

FYI, if you want to post unparsed hyper links you can wrap the address or text in [PLAIN][/PLAIN] tags BB Codes | Centmin Mod Community.

output for
Code (Text):
curl -Iv http://mszp.ro
Code (Text):
curl -Iv https://mszp.ro
Code (Text):
curl -Iv http://web.mszp.ro
Code (Text):
curl -Iv https://web.mszp.ro
Code (Text):
grep -rn 'mszp.ro' /usr/local/nginx/conf/conf.d | grep server_name
also if you're using cloudflare full ssl, make sure to uninstall official cloudflare wordpress plugin as that is only used for cloudflare flexible ssl users

neverminder · Dec 11, 2017

Code (Text):

# curl -Iv http://mszp.ro
* About to connect() to mszp.ro port 80 (#0)
*   Trying 104.27.153.136...
* Connected to mszp.ro (104.27.153.136) port 80 (#0)
> HEAD / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: mszp.ro
> Accept: */*
>
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Date: Mon, 11 Dec 2017 06:10:13 GMT
Date: Mon, 11 Dec 2017 06:10:13 GMT
< Content-Type: text/html; charset=utf-8
Content-Type: text/html; charset=utf-8
< Connection: keep-alive
Connection: keep-alive
< Set-Cookie: __cfduid=d506f9b8045c7d7c1865ef7be06d90d391512972613; expires=Tue, 11-Dec-18 06:10:13 GMT; path=/; domain=.mszp.ro; HttpOnly
Set-Cookie: __cfduid=d506f9b8045c7d7c1865ef7be06d90d391512972613; expires=Tue, 11-Dec-18 06:10:13 GMT; path=/; domain=.mszp.ro; HttpOnly
< Last-Modified: Mon, 11 Dec 2017 03:49:32 GMT
Last-Modified: Mon, 11 Dec 2017 03:49:32 GMT
< Vary: Accept-Encoding
Vary: Accept-Encoding
< Server: cloudflare-nginx
Server: cloudflare-nginx
< CF-RAY: 3cb64795329f9c05-AMS
CF-RAY: 3cb64795329f9c05-AMS

<
* Connection #0 to host mszp.ro left intact

Code (Text):

# curl -Iv https://mszp.ro
* About to connect() to mszp.ro port 443 (#0)
*   Trying 104.27.153.136...
* Connected to mszp.ro (104.27.153.136) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*     subject: CN=sni45979.cloudflaressl.com,OU=PositiveSSL Multi-Domain,OU=Domain Control Validated
*     start date: Dec 09 00:00:00 2017 GMT
*     expire date: Jun 17 23:59:59 2018 GMT
*     common name: sni45979.cloudflaressl.com
*     issuer: CN=COMODO ECC Domain Validation Secure Server CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
> HEAD / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: mszp.ro
> Accept: */*
>
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Date: Mon, 11 Dec 2017 06:14:37 GMT
Date: Mon, 11 Dec 2017 06:14:37 GMT
< Content-Type: text/html; charset=utf-8
Content-Type: text/html; charset=utf-8
< Connection: keep-alive
Connection: keep-alive
< Set-Cookie: __cfduid=d24238a0a7c4a57f0d6ac3231c184a8661512972877; expires=Tue, 11-Dec-18 06:14:37 GMT; path=/; domain=.mszp.ro; HttpOnly
Set-Cookie: __cfduid=d24238a0a7c4a57f0d6ac3231c184a8661512972877; expires=Tue, 11-Dec-18 06:14:37 GMT; path=/; domain=.mszp.ro; HttpOnly
< Last-Modified: Mon, 11 Dec 2017 03:49:32 GMT
Last-Modified: Mon, 11 Dec 2017 03:49:32 GMT
< Vary: Accept-Encoding
Vary: Accept-Encoding
< Server: cloudflare-nginx
Server: cloudflare-nginx
< CF-RAY: 3cb64e05ea909bff-AMS
CF-RAY: 3cb64e05ea909bff-AMS

<
* Connection #0 to host mszp.ro left intact

Code (Text):

# curl -Iv http://web.mszp.ro
* About to connect() to web.mszp.ro port 80 (#0)
*   Trying 62.xxx.xxx.xx...
* Connected to web.mszp.ro (62.xxx.xxx.xx) port 80 (#0)
> HEAD / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: web.mszp.ro
> Accept: */*
>
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Date: Mon, 11 Dec 2017 06:16:08 GMT
Date: Mon, 11 Dec 2017 06:16:08 GMT
< Content-Type: text/html; charset=utf-8
Content-Type: text/html; charset=utf-8
< Content-Length: 1493
Content-Length: 1493
< Last-Modified: Sat, 09 Dec 2017 21:29:12 GMT
Last-Modified: Sat, 09 Dec 2017 21:29:12 GMT
< Connection: keep-alive
Connection: keep-alive
< Vary: Accept-Encoding
Vary: Accept-Encoding
< ETag: "5a2c55a8-5d5"
ETag: "5a2c55a8-5d5"
< Server: nginx centminmod
Server: nginx centminmod
< Expires: Tue, 12 Dec 2017 06:16:08 GMT
Expires: Tue, 12 Dec 2017 06:16:08 GMT
< Cache-Control: max-age=86400
Cache-Control: max-age=86400
< Cache-Control: public, must-revalidate, proxy-revalidate
Cache-Control: public, must-revalidate, proxy-revalidate
< Accept-Ranges: bytes
Accept-Ranges: bytes

<
* Connection #0 to host web.mszp.ro left intact

Code (Text):

# curl -Iv https://web.mszp.ro
* About to connect() to web.mszp.ro port 443 (#0)
*   Trying 62.xxx.xxx.xx...
* Connected to web.mszp.ro (62.xxx.xxx.xx) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* Server certificate:
*     subject: CN=web.mszp.ro,OU=IT,O=web.mszp.ro,L=Los Angeles,ST=California,C=US
*     start date: Dec 09 21:36:23 2017 GMT
*     expire date: Nov 15 21:36:23 2117 GMT
*     common name: web.mszp.ro
*     issuer: CN=web.mszp.ro,OU=IT,O=web.mszp.ro,L=Los Angeles,ST=California,C=US
* NSS error -8172 (SEC_ERROR_UNTRUSTED_ISSUER)
* Peer's certificate issuer has been marked as not trusted by the user.
* Closing connection 0
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

Code (Text):

# grep -rn 'mszp.ro' /usr/local/nginx/conf/conf.d | grep server_name

/usr/local/nginx/conf/conf.d/phpmyadmin_ssl.conf:4:            server_name web.mszp.ro;

/usr/local/nginx/conf/conf.d/mszp.ro.conf:9:#            server_name mszp.ro;

/usr/local/nginx/conf/conf.d/mszp.ro.conf:14:  server_name mszp.ro www.mszp.ro;

/usr/local/nginx/conf/conf.d/mszp.ro.ssl.conf:10:#  server_name mszp.ro www.mszp.ro;

/usr/local/nginx/conf/conf.d/mszp.ro.ssl.conf:16:#  server_name mszp.ro www.mszp.ro;

/usr/local/nginx/conf/conf.d/virtual.conf:4:            server_name web.mszp.ro;

I don't have any cloudflare wp plugin installed.

eva2000 · Dec 11, 2017

grep output looks good as does curl header for
Code (Text):
 curl -Iv https://web.mszp.ro
it reports that https/ssl isn't setup
and curl header check for https version works too
Code (Text):
curl -Iv https://mszp.ro
so means too many redirects is happening at browser caching level it seems

tried a different browser/incognito session + clear browser cache + HSTS cache as well + reboot your local pc ?

neverminder · Dec 11, 2017

You can see for yourself right now. I enabled full SSL on Cloudflare. http://mszp.ro working as expected, https://mszp.ro is redirecting to http://web.mszp.ro (mainhost).

LE: wp and server URLs in wp admin are http

neverminder · Dec 11, 2017

I uncommented the following lines in mszp.ro.ssl.conf:

Code (Text):

server {
  server_name mszp.ro www.mszp.ro;
   return 302 https://mszp.ro$request_uri;
}

Testing nginx now warns me:

Code (Text):

# nginx -t
nginx: [warn] conflicting server name "mszp.ro" on 0.0.0.0:80, ignored
nginx: [warn] conflicting server name "www.mszp.ro" on 0.0.0.0:80, ignored
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

Log in / Register

Forums

Join the community today

Nginx nginx not starting "unknown server_https variable"

neverminder Member

neverminder Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

neverminder Member

neverminder Member

neverminder Member

eva2000 Administrator Staff Member

neverminder Member

eva2000 Administrator Staff Member

neverminder Member

neverminder Member

eva2000 Administrator Staff Member

neverminder Member

neverminder Member

eva2000 Administrator Staff Member

neverminder Member

eva2000 Administrator Staff Member

neverminder Member

neverminder Member

.

Log in / Register

Useful Searches

Join the community today

Nginx nginx not starting "unknown server_https variable"

neverminder Member

neverminder Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

neverminder Member

neverminder Member

neverminder Member

eva2000 Administrator Staff Member

neverminder Member

eva2000 Administrator Staff Member

neverminder Member

neverminder Member

eva2000 Administrator Staff Member

neverminder Member

neverminder Member

eva2000 Administrator Staff Member

neverminder Member

eva2000 Administrator Staff Member

neverminder Member

neverminder Member

.