2

I'm currently trying to setup redirection from HTTP to HTTPS in Nginx.

Used ports:

  • HTTP: 8085
  • HTTPS: 443

When I access the site via http://example.de:8085 initially, I am correctly forwarded to https://example.de. On all following attempts however, the redirect leads to https://example.de:8085 which will then give me the errorcode SSL_ERROR_RX_RECORD_TOO_LONG in Firefox.

Nginx config for port 8085:

server { ## HTTPS redirect server

  listen *:8085;
 
  server_name example.de;
  server_tokens off;

  location / {
    return 301 https://example.de:443$request_uri;
  } 

  # Pass headers because we are serving monitoring endpoints directly without
  # redirection
  proxy_set_header Host $http_host_with_default;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;
  proxy_set_header X-Forwarded-Ssl on;
  proxy_set_header X-Forwarded-Proto https; 

  access_log  /var/log/server/access.log access;
  error_log   /var/log/server/error.log error;
} ## end HTTPS redirect server

When deleting all browser cache, it works again for only one attempt. Therefore my best guess is currently that this might be a caching issue. Is there anything I need to add to the response header?

3
  • 1
    Why are you using port 8085 rather than port 80? Oct 25, 2023 at 18:54
  • 2
    Are you using HSTS (strict transport security)? Oct 25, 2023 at 18:54
  • @StephenOstermiller HSTS - that's the problem! Thanks so much for your help! It's a legacy system that ran for years on the LAN with http on port 8085. Now we enabled https but still need all the old links to keep working. That's why the redirection has to work. I guess the solution then is to just disable HSTS. Is it even possible to have it working with HSTS in this scenario?
    – Lukas
    Oct 26, 2023 at 16:02

1 Answer 1

1

HSTS RFC 6797 states:

if the URI contains an explicit port component that is not equal to "80", the port component value MUST be preserved;

So HSTS will just change http://example.de:8085 to https://example.de:8085. It never adds or removes port numbers.

One option is to disable HSTS.

The other option is to serve both HTTP and HTTPS on port 8085. You might want to have the HTTPS server on port 8085 just redirect to remove the port number. Evidentially, this can be accomplished with some status 497 trickery using the Nginx web server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.