Home / server / Questions / 359574
In Process
zentenk
Asked: 2012-02-14 06:16:17 +0800 CST

force ssl nginx with port

  • 772

I am trying to force ssl redirect, but my domain has a port like so domain.com:8888

The following doesn't seem to be working, now I am not even able to access the site if I add the rewrite

server {
    listen 8888;
    server_name sy-system.net;
    rewrite     ^   https://$server_name:8888$request_uri? permanent; 

    ssl on;
    ssl_certificate /path/to/certs/domain.pem;
    ssl_certificate_key /path/to/certs/domain.key;
}
ssl nginx https

3 Answers

  1. It isn't possible to handle both SSL and non-SSL requests on a single port. You'll need to use a second port for the SSL version if you want to serve both on the same domain.

    • 3

  2. There are two ways to do this, through a dual HTTP HTTPS server block or using two server blocks (preferred) This uses one server block to listen to the 8888 port and the standard 443 SSL port.

    # Server accepts 8888 and SSL but redirects to HTTPS when no SSL protocol used
server {
    listen   8888;            # usually 80
    listen   443 ssl;

    server_name example.com; # replace example.com with your domain name

    ssl on;
    ssl_certificate /path/to/certs/domain.pem;
    ssl_certificate_key /path/to/certs/domain.key;

    if ($ssl_protocol = "") {
         rewrite (.*) https://$server_name$1 permanent;
    }
}

    There is another way that avoids if statements by splitting the server into two blocks.

    # SSL Site
server {
    listen   443 ssl;
    server_name example.com; # replace example.com with your domain name

    ssl on;
    ssl_certificate /path/to/certs/domain.pem;
    ssl_certificate_key /path/to/certs/domain.key;
}

# Non-SSL Site
server {
    listen   8888;            # usually 80
    server_name example.com; # replace example.com with your domain name

    rewrite (.*) https://$server_name$1 permanent;
}

    Please note that these were not tested since I use standard ports (80,443) but inferred from reading the documentation. You might also want to include the IP Address in the listen statement since SSL must be bound to a dedicated IP anyways.

    Sources:

    • 3

  3. It is possible.

    If you you are using the port in the URI:

        server {
        listen 8888 ssl; # listen for ipv4; this line is default and implied
        ssl on;
        ssl_certificate /path/to/certs/domain.pem;
        ssl_certificate_key /path/to/certs/domain.key;
        error_page 497 https://$server_name:8888$request_uri;
    }

    For no port in URI:

        server {
        listen 8888 ssl;
        ssl on;
        ssl_certificate /path/to/certs/domain.pem;
        ssl_certificate_key /path/to/certs/domain.key;
        error_page 497 https://$server_name$request_uri;
    }
    • 1