nginx https ip address to domain redirect

Question

My website is pretty messed up: it shows up as an IP address in the google search results (https). I want to redirect this to my domain, but when I couldn't figure out how to redirect https to my domain (I could only figure out how to redirect http). Here is my current nginx config file:

# Catchall configuration - redir to the domain for bare and invalid domain requests
server {
    listen 80 default_server;

    server_name _;

    return 301 https://mosachi.ga$request_uri;
}

# HTTP handler to redirect to HTTPS for mosachi.ga
server {
  listen 80;
  server_name  mosachi.ga;
  return 301 https://mosachi.ga$request_uri;
}

# HTTPS for mosachi.ga
server {
  listen       443 ssl;
  server_name  mosachi.ga;

  ssl_certificate  /etc/letsencrypt/live/mosachi.ga/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/mosachi.ga/privkey.pem;

  location / {
    proxy_pass http://localhost:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
  }
}

Answer 1

The biggest hurdle is getting a security certificate for the IP address. It is possible to get an IP address certificate, however LetsEncrypt does not issue them, so you would have to purchase one. Without an SSL certificate for the IP address, users won't be able to see your content at the HTTPS IP address. They will instead see scary warnings that the site is not secure.

Once you have a certificate, you should be able to add a block on nginx configuration for it:

# HTTPS for IP address
server {
  listen       443 ssl;
  server_name  31.220.108.250;

  ssl_certificate  /etc/ssl/31.220.108.250/fullchain.pem;
  ssl_certificate_key /etc/ssl/31.220.108.250/privkey.pem;

  return 301 https://mosachi.ga$request_uri;
}

If it were me, I would not do this. Google will sort it out within a couple weeks. You could help Google by including a canonical tag in your pages. That way Google will know to index your site at the domain name. You could also create a default SSL site that uses a fake certificate. While users won't be able to see the site without clicking past very scary warnings, it might help Googlebot get redirected to the right place.

# Catchall HTTPS redirect
server {
  listen 443 default_server;

  server_name _;

  ssl_certificate  /etc/ssl/certs/ssl-cert-snakeoil.pem;
  ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;

  return 301 https://mosachi.ga$request_uri;
}

This default server should go above your other 443 server in the config file.

On a side note, your "HTTP handler to redirect to HTTPS for mosachi.ga" configuration section is redundant. It does the same redirect as the HTTP default server. You can safely remove the redundant configuration section.