nginx. How to set up a non-WWW redirect for a domain with a Let's Encrypt SSL certificate (http/2)?

V

Vic Shostak2017-10-03 11:05:47

Nginx

Vic Shostak, 2017-10-03 11:05:47

Good time.
Stupid question, but Google did not help to solve it (or "..either the skis do not go, or I'm fucked up"). Situation: I bought a new VDS and decided to immediately roll the latest Debian 9 x64. I updated everything, configured it, got SSL from Let's Encrypt for the domain. Configured NGINX (nginx/1.13.5) as follows (my battle config from another VDS):

server {
    listen 80;
    listen [::]:80;

    server_name example.com www.example.com;

    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    access_log off;

    server_name www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 127.0.0.1 8.8.8.8;

    add_header Strict-Transport-Security "max-age=31536000";
    expires max;

    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    
    server_name example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 127.0.0.1 8.8.8.8;

    add_header Content-Security-Policy "block-all-mixed-content";
    add_header Strict-Transport-Security "max-age=31536000";
    expires max;

    root /var/www/html/example.com;
    index index.html;

    include acme; # файл с конфигом location / ... {..} для (пере)генерации SSL

    location / {
        try_files $uri $uri/ =404;
    }
}

So the problem is that on my other VDS with Debian 8 - this config correctly redirects:

from www.example.com [80, WWW] to https://example.com [443]
from https://www.example.com [443, WWW] to https://example.com [443]

And on the new Debian 9, it just gives a 404 error. What am I doing wrong?
PS I understand that Debian has nothing to do with it, but for some reason stupid copy-paste doesn't work...

Reply

Answer the question

In order to leave comments, you need to log in

1 answer(s)

M

Mikhail Grigoriev, 2017-10-03
@vikkyshostak

Most likely the problem is that you didn't copy some Nginx configs that define default_server.
Check /etc/nginx/nginx.conf for include.
For example:

include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;

To understand how Nginx handles requests, be sure to read this
. To understand how try_files works, read this
. Also, check the presence of index.html in the /var/www/html/example.com directory, the owner of the file and the rights.
Below is one of the correct config options, there may be another option, up to the fact that server {} can be done with only 1 and pile up a bunch of if, but if is evil and wrong.

server {
        listen XX.XX.XX.XX:80;
        server_name example.com;
        return 301 https://example.com$request_uri;
}
server {
        listen XX.XX.XX.XX:80;
        listen XX.XX.XX.XX:443 http2 ssl;
        server_name www.example.com;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
        ssl_session_cache shared:SSL:50m;
        ssl_session_timeout 5m;
        ssl_dhparam /etc/nginx/ssl/dhparams.pem;
        ssl_prefer_server_ciphers on;
        ssl_session_tickets off;
        ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
        resolver 8.8.8.8 8.8.4.4 valid=300s;
        resolver_timeout 5s;
        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/nginx/ssl/letsencrypt-ca.pem;
        ssl_stapling_responder http://ocsp.int-x3.letsencrypt.org;
        return 301 https://example.com$request_uri;
}
server {
        listen XX.XX.XX.XX:443 http2 ssl;
        server_name example.com;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
        ssl_session_cache shared:SSL:50m;
        ssl_session_timeout 5m;
        ssl_dhparam /etc/nginx/ssl/dhparams.pem;
        ssl_prefer_server_ciphers on;
        ssl_session_tickets off;
        ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
        resolver 8.8.8.8 8.8.4.4 valid=300s;
        resolver_timeout 5s;
        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/nginx/ssl/letsencrypt-ca.pem;
        ssl_stapling_responder http://ocsp.int-x3.letsencrypt.org;

        add_header Strict-Transport-Security "max-age=31536000";
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";

        root /var/www/html/example.com;
        index index.html index.htm;

        include acme;

        location / {
                try_files $uri $uri/ /index.html;
        }

}

Instead of XX.XX.XX.XX, enter your IP address on the VDS.
mkdir /etc/nginx/ssl/
openssl dhparam -out /etc/nginx/ssl/dhparams.pem 2048

FILE /etc/nginx/ssl/letsencrypt-ca.pem

Also, be sure to define default_server, for example, in the /etc/nginx/conf.d/fallback.conf file, you can write:

server {
        listen XX.XX.XX.XX:80 default_server;
        server_name _;
        return 444;
}

default_server is useful for processing incorrect requests, for example, requests without the "Host" field.
In my example, just above, nginx will simply close the connection for such requests, for this a special is used. code 444.