4 ms·

Possibly a stupid question, but why not make whichever vhost is correctly configured for SSL your default? Any traffic will go there unless another match is fou

Possibly a stupid question, but why not make whichever vhost is correctly configured for SSL your default? Any traffic will go there unless another match is found. This is what I do to force SSL and redirect anything not matching another vhost. Catch-all + HTTP --> HTTPS server { # Set server name & make it the default for this IP address listen 80 default_server; listen [::]:80 default_server ipv6only=on; return 301 https://EXAMPLE.TLD$request_uri; } Or, rewrite HTTPS to HTTP for that vhost only server { listen 443; server_name EXAMPLE.TLD; return 301 http://EXAMPLE.TLD$request_uri; } Mozilla's server-side TLS wiki at https://wiki.mozilla.org/Security/Server_Side_TLS https://wiki.mozilla.org/Security/Server_Side_TLS is the best documentation I've found yet, and includes great examples of complete configs for various servers. Hope that helps.

toast0 12y ago
That's not helpful, he doesn't have a cert for www.sslscoop.org, so the link is http; but if you try https://www.sslscoop.org/ https://www.sslscoop.org/ you get a cert error, because the IP(s) are running https, but for a different name. By the time the server can return the redirect you propose, the user agent must have already accepted the non-matching certificate.
- tombrossman 12y ago
  Hmm, good to know then. Is there a working Nginx config you can point me to for this use case, because I'd like to solve this issue too. My setup happens to be one HTTPS only server and one HTTP only, but it would be good to know in case I want to mix things up. Testing a couple third-party sites, our local bus company simply times out when you manually input https://www.libertybus.je https://www.libertybus.je. Doing this on the main BBC site https://www.bbc.co.uk/ https://www.bbc.co.uk/ quickly returns you to the http version. Those are different setups but the cert errors do not happen, which is the goal here.

toast0 12y ago

That's not helpful, he doesn't have a cert for www.sslscoop.org, so the link is http; but if you try https://www.sslscoop.org/ https://www.sslscoop.org/ you get a cert error, because the IP(s) are running https, but for a different name. By the time the server can return the redirect you propose, the user agent must have already accepted the non-matching certificate.

tombrossman 12y ago
Hmm, good to know then. Is there a working Nginx config you can point me to for this use case, because I'd like to solve this issue too. My setup happens to be one HTTPS only server and one HTTP only, but it would be good to know in case I want to mix things up. Testing a couple third-party sites, our local bus company simply times out when you manually input https://www.libertybus.je https://www.libertybus.je. Doing this on the main BBC site https://www.bbc.co.uk/ https://www.bbc.co.uk/ quickly returns you to the http version. Those are different setups but the cert errors do not happen, which is the goal here.