There is a weird issue I am having with my Nginx server. I am hosting static files using ssl with certificates from 1&1. A friend from the UK and a friend from Germany have reported that they can not access my website while multiple friends from Germany and the UK can access the website without any issues. Non of the people who have tested have ever accessed the website before to make sure the test results aren't skewed with by browser history. When typing the url Nginx sends them to url/defaultpage which is not one of my routes.
I hosted the exact same website on a different machine running nginx 1.14.0 (instead of 1.16.1) which solved the issue for one of my testers. This seems very arbitrary, has anyone ever had this issue?
My config file
server {
listen 0.0.0.0:443;
root /home/ubuntu/vue-project/dist/;
ssl on;
ssl_certificate /home/ubuntu/vue-project/certs/bundle.crt;
ssl_certificate_key /home/ubuntu/vue-project/certs/key.key;
location / {
try_files $uri $uri/ /index.html;
}
}
A redirect script I am using to send all http requests to my https port
server {
listen 80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
Related
I'm learning how to build and host my own website using Python and Flask, but I'm unable to make my website work as I keep getting an infinite redirect loop when I try to access my website through my domain name.
I've made my website using Python, Flask, and Flask-Flatpages. I uploaded the code to GitHub and pulled it onto a Raspberry Pi 4 that I have at my house. I installed gunicorn on the RasPi to serve the website and set up two workers to listen for requests. I've also set up nginx to act as a reverse proxy and listen to requests from outside. Here is my nginx configuration:
server {
if ($host = <redacted>.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
# listen on port 80 (http)
listen 80;
server_name <redacted>.com www.<redacted>.com;
location ~ /.well-known {
root /home/pi/<redacted>.com/certs;
}
location / {
# redirect any requests to the same URL but on https
return 301 https://$host$request_uri;
}
}
server {
# listen on port 443 (https)
listen 443;
ssl on;
server_name <redacted>.com www.<redacted>.com;
# location of the SSL certificate
ssl_certificate /etc/letsencrypt/live/<redacted>.com/fullchain.pem; # m$
ssl_certificate_key /etc/letsencrypt/live/<redacted>.com/privkey.pem; #$
# write access and error logs to /var/log
access_log /var/log/blog_access.log;
error_log /var/log/blog_error.log;
location / {
# forward application requests to the gunicorn server
proxy_pass http://localhost:8000;
proxy_redirect off;
proxy_set_header X_Forwarded_Proto $scheme;
proxy_set_header Host $host;
location /static {
# handle static files directly, without forwarding to the application
alias /home/pi/<redacted>.com/blog/static;
expires 30d;
}
}
When I access the website by typing in the local IP of the RasPi (I've set up a static IP address in /etc/dhcpcd.conf), the website is served just fine, although it seems like my browser won't recognize the SSL certificate even though Chrome says the certificate is valid when I click on Not Secure > Certificate next to the .
To make the website public, I've forwarded port 80 on my router to the RasPi and set up ufw to allow requests only from ports 80, 443, and 22. I purchased a domain name using GoDaddy, then added the domain to CloudFlare by changing the nameservers in GoDaddy (I'm planning to set up cloudflare-ddns later, which is why I added the domain to CloudFlare in the first place). As a temporary solution, I've added the current IP of my router to the A Record in the CloudFlare DNS settings, which I'm hoping will be the same for the next few days.
My problem arises when I try to access my website via my public domain name. When I do so, I get ERR_TOO_MANY_REDIRECTS, and I suspect this is due to some problem with my nginx configuration. I've already read this post and tried changing my CloudFlare SSL/TLS setting from Flexible to Full (strict). However, this leads to a different problem, where I get a CloudFlare error 522: connection timed out. None of the solutions in the CloudFlare help page seem to apply to my situation, as I've confirmed that:
I haven't blocked any CloudFlare IPs in ufw
The server isn't overloaded (I'm the only one accessing it right now)
Keepalive is enabled (I haven't changed anything from the default, although I'm unsure whether it is enabled by default)
The IP address in the A Record of the DNS Table matches the Public IP of my router (found through searching "What is my IP" on google)
Apologies if there is a lot in here for a single question, but any help would be appreciated!
I only see one obvious problem with your config, which is that this block that was automatically added by certbot should probably be removed:
if ($host = <redacted>.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
Because that behavior is already specified in the location / {} block, and I think the Certbot rule may take effect before the location ~ /.well-known block and break that functionality. I'm not certain about that, and I don't think that would cause the redirects, but you can test the well-known functionality yourself by trying to access http://yourhost.com/.well-known and seeing if it redirects to HTTPS or not.
On that note, the immediate answer to your question is, get more information about what's happening! My next step would be to see what the redirect loop is - your browser may show this in its network requests log, or you can use a command-line tool like curl or httpie or similar to try to access your site via the hostname and see what requests are being made. Is it simply trying to access the same URL over and over, or is it looping through multiple URLs? What are they? What does that point at?
And as a side note, it makes sense that Chrome wouldn't like your certificate when accessing it via IP - certificates are tied to one or more hostnames, so when you're accessing it over an IP address, the hostname doesn't match, so Chrome is probably (correctly) pointing that out and warning you that you're not at the hostname the certificate says you should be at.
All my sites are return 301 response code instead of 200. My sites are hosted on amazon aws and my dns are managed by cloudflare. I am using free ssl from cloudflares.
I was testing my site in third party websites. And it seems everywhere i am getting the following error:
Your server did not return a valid HTTP code (You returned 301 when you should have returned 200).
My server is configured using nginx. this is my nginx server code:
server {
listen 80;
listen 443 ssl;
root /media/6sense/www/shajao.com;
index index.html index.htm index.nginx-debian.html;
server_name shajao.com www.shajao.com;
location / {
try_files $uri$args $uri$args/ /index.html;
}
}
This is my website.
https://shajao.com/
Your site returns a 301 when requested over HTTP, in order to redirect to HTTPS. That is, if someone tries to fetch http://shajao.com, they get a 301 redirect to https://shajao.com. This is a good thing: Everyone should use HTTPS instead of HTTP. If you tell those third-party web sites to use HTTPS, it should work -- make sure to type in your web site URL starting with https://. With that said, if you really want to allow traffic over HTTP, you can turn off the option "Always Use HTTPS" in your Cloudflare settings.
I have several websites hosted on the same sever. To simplify I have just 2 (http-only.com and https.com) and using nginx to handle requests.
One has SSL enabled. And another doesn't. I noticed links like this in Google Search Console http-only.com/https_server_path and when accessing an http-only.com server with https protocol I get requests served by an https.com server instead.
https.com:
server {
listen 443 ssl;
server_name https.com;
ssl on;
}
only-http.com:
server {
listen 80;
server_name only-http.com;
}
I think I should define something like a default ssl server to handle ssl for http.com, but don't know how to do it properly. I guess nginx should redirect https request to an http url if corresponding server doesn't handle https. Or maybe there is a better solution?
I have a web service hosted on local ip 192.168.1.21:8080 (Apache Tomcat) which is up and running (ie I can surf to that IP and get the tomcat front page as expected).
I'm now trying to set up a proxy rule in my nginx saying that the url "jft.pdf.home.se" should redirect to that ip (using below nginx proxy rule:)
# GeneratePDF
server{
listen 80;
server_name jft.pdf.home.se;
#GeneratePDF
location / {
proxy_pass http://192.168.1.21:8080/;
include /etc/nginx/proxy_params;
}
}
When I try to surf to jft.pdf.home.se I get page cannot be found error. Again, if I use 192.168.1.21:8080, it works fine.
I also tried changing server_name to pdf.home.se but with the same result.
Can anyone see what I might be missing?
I soon realized that I hadn't posted this DNS yet which was what caused the page not found!
So I've got this port 80 redirect working fine
server {
listen 80;
server_name "~^(?<subdomain>.+)\.site-box\.it$";
rewrite ^(.*)$ https://$subdomain.sitebox.co permanent;
}
But I want https to work too, because some old links are left around that have https://guy.site-box.it
But this doesn't work
server {
listen 443;
server_name "~^(?<subdomain>.+)\.site-box\.it$";
rewrite ^(.*)$ https://$subdomain.sitebox.co permanent;
}
It seems to cause nothing in the Nginx conf file to work. I just get cloudflare errors on the main site, and on the testing guy.site-box.it it just says page is not available.
Any idea how to get the SSL subdomain to work?
First of all you need 2 certificates: for subdomain.site-box.it and for subdomain.sitebox.co. If you have wildcard certificate - good, can use one server block. If you have separate certificate - need to create one server for each subdomain (because certificate paths are different).
Also, you need openssl with SNI support (well, almost all modern version has) and check browser/os support. SNI - it's for https name-based hosting.
Also, better use return 301 instead of rewrite. return 301 https://$subdomain.sitebox.co much better.
And finally you server block not configured well. You forgot ssl keyword and certificate paths.
server {
listen 443 ssl;
ssl_certificate ... ;
ssl_certificate_key ... ;
}