151

I'm running a Sinatra app behind passenger/nginx. I'm trying to get it to respond to both http and https calls. The problem is, when both are defined in the server block https calls are responded to normally but http yields a 400 "The plain HTTP request was sent to HTTPS port" error. This is for a static page so I'm guessing Sinatra has nothing to do with this. Any ideas on how to fix this?

Here's the server block:

server {
        listen 80;
        listen 443  ssl;
        server_name localhost;
        root /home/myhome/app/public;
        passenger_enabled on;

        ssl on;
        ssl_certificate      /opt/nginx/ssl_keys/ssl.crt;
        ssl_certificate_key  /opt/nginx/ssl_keys/ssl.key;
        ssl_protocols        SSLv3 TLSv1;
        ssl_ciphers          HIGH:!aNULL:!MD5;

        location /static {
            root  /home/myhome/app/public;
            index  index.html index.htm index.php;
        }

        error_page 404 /404.html;

        # redirect server error pages to the static page /50x.html
        error_page 500 /500.html;

        access_log /home/myhome/app/logs/access.log;
        error_log /home/myhome/app/logs/error.log;
}
2
  • In my case was that the url in browser: my.example.com:443 didn't work. Changing that instead to https://my.example.com worked. Weird, never had this problem with apache.
    – Sebastian
    Commented Oct 6, 2016 at 18:43
  • 1
    ssl on; tells NGINX to server ANY content through SSL. Use "ssl" flag at the end of your listen 443; e.g listen 443 ssl;if your server delivers both http and https traffic, and remove ssl on; directive.
    – Stphane
    Commented Dec 10, 2016 at 9:44

11 Answers 11

210

I ran into a similar problem. It works on one server and does not on another server with same Nginx configuration. Found the the solution which is answered by Igor here http://forum.nginx.org/read.php?2,1612,1627#msg-1627

Yes. Or you may combine SSL/non-SSL servers in one server:

server {
  listen 80;
  listen 443 default ssl;

  # ssl on   - remember to comment this out

}
8
  • Per what rapam iosif says, be sure you also include ssl off; Commented Jun 11, 2012 at 19:24
  • 22
    You only need to remove the line ssl on; (no need to add ssl off). Also, since I don't remember which Nginx version, there is no more need to use default on listen 443 line. So the OP config was OK, only need to remove ssl on and it should work.
    – laurent
    Commented Dec 2, 2012 at 1:10
  • @bobojam feel free to include the explanation from my answer, so that yours will be more complete. I've asked OP author to accept you answer. Commented Dec 27, 2012 at 8:49
  • 2
    How does it solve the SSL purpose by commenting ssl on. @MichaelJ.Evans answer below is a much better solution.
    – Neel
    Commented Oct 19, 2014 at 21:43
  • 1
    Doesn't seem to work with multiple conf files. Says there are 2 duplicate defaults. Use Alexander's solution.
    – Ryall
    Commented May 7, 2016 at 21:54
63

The above answers are incorrect in that most over-ride the 'is this connection HTTPS' test to allow serving the pages over http irrespective of connection security.

The secure answer using an error-page on an NGINX specific http 4xx error code to redirect the client to retry the same request to https. (as outlined here https://serverfault.com/questions/338700/redirect-http-mydomain-com12345-to-https-mydomain-com12345-in-nginx )

The OP should use:

server {
  listen        12345;
  server_name   php.myadmin.com;

  root         /var/www/php;

  ssl           on;

  # If they come here using HTTP, bounce them to the correct scheme
  error_page 497 https://$server_name:$server_port$request_uri;

  [....]
}
3
  • 1
    You probably want $server_name instead of $host, the server_name presumably being set to the CN that the SSL cert authenticates. That way, the user won't get a scare screen if they came in via an IP or localhost.
    – George
    Commented Nov 9, 2013 at 5:31
  • I was trying to implement this on my local install of GitLab, but used the Inserting custom NGINX settings into the GitLab server block method thus nginx['custom_gitlab_server_config'] = "error_page 497 https://$host:$server_port$request_uri;" did the trick
    – Aaron C
    Commented Jun 30, 2016 at 16:13
  • 1
    While $server_name prevents users from Scare Screening, sometimes you still want to use $host instead. In my case docker run sends a request that ends up in $server_name being empty, but $host being set as expected.
    – Simon
    Commented Apr 12, 2023 at 13:51
19

The error says it all actually. Your configuration tells Nginx to listen on port 80 (HTTP) and use SSL. When you point your browser to http://localhost, it tries to connect via HTTP. Since Nginx expects SSL, it complains with the error.

The workaround is very simple. You need two server sections:

server {
  listen 80;

  // other directives...
}

server {
  listen 443;

  ssl on;
  // SSL directives...

  // other directives...
}
1
  • 7
    You don't actually need two server sections. Remove the "ssl on" line and change the listen lines as per @bobojam's answer.
    – toxaq
    Commented Aug 14, 2012 at 0:16
17

According to wikipedia article on status codes. Nginx has a custom error code when http traffic is sent to https port(error code 497)

And according to nginx docs on error_page, you can define a URI that will be shown for a specific error.
Thus we can create a uri that clients will be sent to when error code 497 is raised.

nginx.conf

#lets assume your IP address is 89.89.89.89 and also 
#that you want nginx to listen on port 7000 and your app is running on port 3000

server {
    listen 7000 ssl;
 
    ssl_certificate /path/to/ssl_certificate.cer;
    ssl_certificate_key /path/to/ssl_certificate_key.key;
    ssl_client_certificate /path/to/ssl_client_certificate.cer;

    error_page 497 301 =307 https://89.89.89.89:7000$request_uri;

    location / {
        proxy_pass http://89.89.89.89:3000/;

        proxy_pass_header Server;
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Protocol $scheme;
    }
}

However if a client makes a request via any other method except a GET, that request will be turned into a GET. Thus to preserve the request method that the client came in via; we use error processing redirects as shown in nginx docs on error_page

And thats why we use the 301 =307 redirect.

Using the nginx.conf file shown here, we are able to have http and https listen in on the same port

2
12

I had the exact same issue, I have kind of the same configuration as your exemple and I got it working by removing the line :

ssl on;

To quote the doc:

If HTTP and HTTPS servers are equal, a single server that handles both HTTP and HTTPS requests may be configured by deleting the directive “ssl on” and adding the ssl parameter for *:443 port

1
  • 1
    Any chance you have the link to doc? Commented Mar 31, 2016 at 23:24
9

Here is an example to config HTTP and HTTPS in same config block with ipv6 support. The config is tested in Ubuntu Server and NGINX/1.4.6 but this should work with all servers.

server {
    # support http and ipv6
    listen 80 default_server;
    listen [::]:80 default_server ipv6only=on;

    # support https and ipv6
    listen 443 default_server ssl;
    listen [::]:443 ipv6only=on default_server ssl;

    # path to web directory
    root /path/to/example.com;
    index index.html index.htm;

    # domain or subdomain
    server_name example.com www.example.com;

    # ssl certificate
    ssl_certificate /path/to/certs/example_com-bundle.crt;
    ssl_certificate_key /path/to/certs/example_com.key;

    ssl_session_timeout 5m;

    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
    ssl_prefer_server_ciphers on;
}

Don't include ssl on which may cause 400 error. The config above should work for

http://example.com

http://www.example.com

https://example.com

https://www.example.com

Hope this helps!

4

if use phpmyadmin add: fastcgi_param HTTPS on;

4

Actually you can do this with:

ssl off; 

This solved my problem in using nginxvhosts; now I am able to use both SSL and plain HTTP. Works even with combined ports.

1
  • Works for me on nginx/1.6.3 :)
    – djthoms
    Commented Oct 25, 2015 at 3:53
2

its error 497 and not error 400 . you can handle Error 497 like this and redirect http to https with a 301 (moved permanently) or 302 (moved temporary) like this:

error_page 497 = @foobar;

location @foobar {
return 301 https://$host:$server_port$request_uri;
}

this will redirect you to the exact url you requested but replace your request 'http' with 'https' with no error or confirm (its 301 redirect and counts as seo safe)

0

In my case my response redirected from jenkins to 443

Just added a proxy redirect in nginx configuration to make it work

proxy_redirect http://test.example.com:443/ https://test.example.com/;

0

In my case just those lines help me:

   if ($scheme = 'http') {
        return 301 https://$server_name$request_uri;
    }
1
  • 2
    Please read How to Answer and edit your answer to contain an explanation as to why this code would actually solve the problem at hand. Always remember that you're not only solving the problem, but are also educating the OP and any future readers of this post.
    – Adriaan
    Commented Jan 16, 2023 at 9:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.