Site d't work after ssl activation

Hi! I have a problem with working of my site after installation ssl certificate and changes settings in Nginx.
On the working site i have 2 files at directory /etc/nginx/sites-available

default

server {
	listen 80 default_server;
	listen [::]:80 default_server;
	root /var/www/html;

	server_name _;

	location / {
		# First attempt to serve request as file, then
		# as directory, then fall back to displaying a 404.
		try_files $uri $uri/ =404;
	}

and protrack

server {
    listen 80;
    server_name protrack.by www.protrack.by;

    location ~ /.well-known {
                allow all;
    root /var/www/html;
        }

    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /home/gk/protrack;
    }

    location / {
        include         uwsgi_params;
        uwsgi_pass      unix:/run/uwsgi/protrack.sock;
    }
}

With the above settings, I was able to get a certificate and the site worked on the old http protocol. To go to https, I made the following changes to protrack and left default without changing (if I honestly do not know why I need this file)

/etc/nginx/sites-available/protrack

server {
    listen 80;
    listen [::]:80;
    server_name protrack.by www.protrack.by;
    return 301 https://protrack.by$request_uri;

    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /home/gk/protrack;
    }

    location / {
        include         uwsgi_params;
        uwsgi_pass      unix:/run/uwsgi/protrack.sock;
    }
}

server {
        listen 443 ssl;
        server_name www.protrack.by;
        return 301 https://protrack.by$request_uri;
}

server {

        # SSL configuration

        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        include snippets/ssl-protrack.by.conf;
        include snippets/ssl-params.conf;

        root /var/www/html;
        

        server_name protrack.by;

        location ~ /\.ht {
            deny all;
        }
}

And now http redirect to https redirect is work, www to non www is work, but when I try to go to the site it d’nt work. Please help

My domain is:protrack.by

My web server is (include version): debian 9.2

The operating system my web server runs on is (include version): Nginx/Uwsgi

My hosting provider, if applicable, is:DigitalOcean

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): bash

Hi @Lepiloff,

Every server block listen on 443 ssl need the right conf; ssl on, the certificate, the key etc. so you need to add them.

server {
        listen 443 ssl;
        server_name www.protrack.by;
        include snippets/ssl-protrack.by.conf;
        include snippets/ssl-params.conf;
        return 301 https://protrack.by$request_uri;
}

Well, I suppose it won't fix anything because the other server block seems correct but doesn't work too, so, maybe your snippets are not being loaded or the snippets doesn't have the right conf. You could check the nginx logs, maybe them give you more info in case there is another issue.

Also, show the output of this command:

nginx -T

and the contents of snippets/ssl-protrack.by.conf and snippets/ssl-params.conf.

Cheers,
sahsanu

I used this configuration guide http://devanswers.co/configure-lets-encrypt-ssl-nginx-ubuntu-16-04-digitalocean-droplet/

nginx -T log:

attention is very long file

Summary

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

configuration file /etc/nginx/nginx.conf:

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
worker_connections 768;
# multi_accept on;
}

http {

    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # SSL Settings
    ##

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;

}

#mail {

# See sample authentication script at:

# Using a PHP Script on an Apache Server as the IMAP Auth Backend | NGINX

# auth_http localhost/auth.php;

# pop3_capabilities "TOP" "USER";

# imap_capabilities "IMAP4rev1" "UIDPLUS";

server {

listen localhost:110;

protocol pop3;

proxy on;

}

server {

listen localhost:143;

protocol imap;

proxy on;

}

#}

configuration file /etc/nginx/modules-enabled/50-mod-http-auth-pam.conf:

load_module modules/ngx_http_auth_pam_module.so;

configuration file /etc/nginx/modules-enabled/50-mod-http-dav-ext.conf:

load_module modules/ngx_http_dav_ext_module.so;

configuration file /etc/nginx/modules-enabled/50-mod-http-echo.conf:

load_module modules/ngx_http_echo_module.so;

configuration file /etc/nginx/modules-enabled/50-mod-http-geoip.conf:

load_module modules/ngx_http_geoip_module.so;

configuration file /etc/nginx/modules-enabled/50-mod-http-image-filter.conf:

load_module modules/ngx_http_image_filter_module.so;

configuration file /etc/nginx/modules-enabled/50-mod-http-subs-filter.conf:

load_module modules/ngx_http_subs_filter_module.so;

configuration file /etc/nginx/modules-enabled/50-mod-http-upstream-fair.conf:

load_module modules/ngx_http_upstream_fair_module.so;

configuration file /etc/nginx/modules-enabled/50-mod-http-xslt-filter.conf:

load_module modules/ngx_http_xslt_filter_module.so;

configuration file /etc/nginx/modules-enabled/50-mod-mail.conf:

load_module modules/ngx_mail_module.so;

configuration file /etc/nginx/modules-enabled/50-mod-stream.conf:

load_module modules/ngx_stream_module.so;

configuration file /etc/nginx/mime.types:

types {
text/html html htm shtml;
text/css css;
text/xml xml;
image/gif gif;
image/jpeg jpeg jpg;
application/javascript js;
application/atom+xml atom;
application/rss+xml rss;

text/mathml                           mml;
text/plain                            txt;
text/vnd.sun.j2me.app-descriptor      jad;
text/vnd.wap.wml                      wml;
text/x-component                      htc;

image/png                             png;
image/tiff                            tif tiff;
image/vnd.wap.wbmp                    wbmp;
image/x-icon                          ico;
image/x-jng                           jng;
image/x-ms-bmp                        bmp;
image/svg+xml                         svg svgz;
image/webp                            webp;

application/font-woff                 woff;
application/java-archive              jar war ear;
application/json                      json;
application/mac-binhex40              hqx;
application/msword                    doc;
application/pdf                       pdf;
application/postscript                ps eps ai;
application/rtf                       rtf;
application/vnd.apple.mpegurl         m3u8;
application/vnd.ms-excel              xls;
application/vnd.ms-fontobject         eot;
application/vnd.ms-powerpoint         ppt;
application/vnd.wap.wmlc              wmlc;
application/vnd.google-earth.kml+xml  kml;
application/vnd.google-earth.kmz      kmz;
application/x-7z-compressed           7z;
application/x-cocoa                   cco;
application/x-java-archive-diff       jardiff;
application/x-java-jnlp-file          jnlp;
application/x-makeself                run;
application/x-perl                    pl pm;
application/x-pilot                   prc pdb;
application/x-rar-compressed          rar;
application/x-redhat-package-manager  rpm;
application/x-sea                     sea;
application/x-shockwave-flash         swf;
application/x-stuffit                 sit;
application/x-tcl                     tcl tk;
application/x-x509-ca-cert            der pem crt;
application/x-xpinstall               xpi;
application/xhtml+xml                 xhtml;
application/xspf+xml                  xspf;
application/zip                       zip;

application/octet-stream              bin exe dll;
application/octet-stream              deb;
application/octet-stream              dmg;
application/octet-stream              iso img;
application/octet-stream              msi msp msm;

application/vnd.openxmlformats-officedocument.wordprocessingml.document    docx;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet          xlsx;
application/vnd.openxmlformats-officedocument.presentationml.presentation  pptx;

audio/midi                            mid midi kar;
audio/mpeg                            mp3;
audio/ogg                             ogg;
audio/x-m4a                           m4a;
audio/x-realaudio                     ra;

video/3gpp                            3gpp 3gp;
video/mp2t                            ts;
video/mp4                             mp4;
video/mpeg                            mpeg mpg;
video/quicktime                       mov;
video/webm                            webm;
video/x-flv                           flv;
video/x-m4v                           m4v;
video/x-mng                           mng;
video/x-ms-asf                        asx asf;
video/x-ms-wmv                        wmv;
video/x-msvideo                       avi;

}

configuration file /etc/nginx/sites-enabled/default:

You should look at the following URL's in order to grasp a solid understanding

of Nginx configuration files in order to fully unleash the power of Nginx.

Getting Started | NGINX

Pitfalls and Common Mistakes | NGINX

Nginx/DirectoryStructure - Debian Wiki

In most cases, administrators will remove this file from sites-enabled/ and

leave it as reference inside of sites-available where it will continue to be

updated by the nginx packaging team.

This file will automatically load configuration files provided by other

applications, such as Drupal or Wordpress. These applications will be made

available underneath a path with that package name, such as /drupal8.

Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.

Default server configuration

server {
listen 80 default_server;
listen [::]:80 default_server;

    # SSL configuration
    #
    # listen 443 ssl default_server;
    # listen [::]:443 ssl default_server;
    #
    # Note: You should disable gzip for SSL traffic.
    # See: https://bugs.debian.org/773332
    #
    # Read up on ssl_ciphers to ensure a secure configuration.
    # See: https://bugs.debian.org/765782
    #
    # Self signed certs generated by the ssl-cert package
    # Don't use them in a production server!
    #
    # include snippets/snakeoil.conf;

    root /var/www/html;

    # Add index.php to the list if you are using PHP
    index index.html index.htm index.nginx-debian.html;

    server_name _;

    location / {
            # First attempt to serve request as file, then
            # as directory, then fall back to displaying a 404.
            try_files $uri $uri/ =404;
    }

    # pass PHP scripts to FastCGI server
    #
    #location ~ \.php$ {
    #       include snippets/fastcgi-php.conf;
    #
    #       # With php-fpm (or other unix sockets):
    #       fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
    #       # With php-cgi (or other tcp sockets):
    #       fastcgi_pass 127.0.0.1:9000;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #       deny all;
    #}

}

Virtual Host configuration for example.com

You can move that to a different file under sites-available/ and symlink that

to sites-enabled/ to enable it.

#server {

listen 80;

listen [::]:80;

server_name example.com;

root /var/www/example.com;

index index.html;

location / {

try_files $uri $uri/ =404;

}

#}

configuration file /etc/nginx/sites-enabled/djaway:

server {
listen 80;
server_name djaway.net;

location = /favicon.ico { access_log off; log_not_found off; }
location /static/ {
    root /home/gk/djaway;
}

location / {
    include         uwsgi_params;
    uwsgi_pass      unix:/run/uwsgi/myblog.sock;
}

}

configuration file /etc/nginx/uwsgi_params:

uwsgi_param QUERY_STRING $query_string;
uwsgi_param REQUEST_METHOD $request_method;
uwsgi_param CONTENT_TYPE $content_type;
uwsgi_param CONTENT_LENGTH $content_length;

uwsgi_param REQUEST_URI $request_uri;
uwsgi_param PATH_INFO $document_uri;
uwsgi_param DOCUMENT_ROOT $document_root;
uwsgi_param SERVER_PROTOCOL $server_protocol;
uwsgi_param REQUEST_SCHEME $scheme;
uwsgi_param HTTPS $https if_not_empty;

uwsgi_param REMOTE_ADDR $remote_addr;
uwsgi_param REMOTE_PORT $remote_port;
uwsgi_param SERVER_PORT $server_port;
uwsgi_param SERVER_NAME $server_name;

configuration file /etc/nginx/sites-enabled/protrack:

server {
listen 80;
listen [::]:80;
server_name protrack.by www.protrack.by;
return 301 https://protrack.by$request_uri;

location = /favicon.ico { access_log off; log_not_found off; }
location /static/ {
    root /home/gk/protrack;
}

location / {
    include         uwsgi_params;
    uwsgi_pass      unix:/run/uwsgi/protrack.sock;
}

}

server {
listen 443 ssl;
server_name www.protrack.by;
return 301 https://protrack.by$request_uri;
}

server {

    # SSL configuration

    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    include snippets/ssl-protrack.by.conf;
    include snippets/ssl-params.conf;

    root /var/www/html;


    server_name protrack.by;

    location ~ /\.ht {
        deny all;
    }

}

configuration file /etc/nginx/uwsgi_params:

uwsgi_param QUERY_STRING $query_string;
uwsgi_param REQUEST_METHOD $request_method;
uwsgi_param CONTENT_TYPE $content_type;
uwsgi_param CONTENT_LENGTH $content_length;

uwsgi_param REQUEST_URI $request_uri;
uwsgi_param PATH_INFO $document_uri;
uwsgi_param DOCUMENT_ROOT $document_root;
uwsgi_param SERVER_PROTOCOL $server_protocol;
uwsgi_param REQUEST_SCHEME $scheme;
uwsgi_param HTTPS $https if_not_empty;

uwsgi_param REMOTE_ADDR $remote_addr;
uwsgi_param REMOTE_PORT $remote_port;
uwsgi_param SERVER_PORT $server_port;
uwsgi_param SERVER_NAME $server_name;

configuration file /etc/nginx/snippets/ssl-protrack.by.conf:

ssl_certificate /etc/letsencrypt/live/protrack.by/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/protrack.by/privkey.pem;

configuration file /etc/nginx/snippets/ssl-params.conf:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

disable HSTS header for now

#add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
ssl_dhparam /etc/ssl/certs/dhparam.pem;

snippets/ssl-protrack.by.conf

ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

snippets/ssl-params.conf

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
# disable HSTS header for now
#add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
ssl_dhparam /etc/ssl/certs/dhparam.pem;

Are you using example.com in the path to your cert and key?

1 Like

Ups, sorry wrong copypast
The true code is

ssl_certificate /etc/letsencrypt/live/protrack.by/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/protrack.by/privkey.pem;

I try to change /etc/nginx/sites-available/protrack to

server {
    listen 80;
    listen [::]:80;
    server_name protrack.by www.protrack.by;
    return 301 https://$server_name$request_uri;

    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /home/gk/protrack;
    }

    location / {
        include         uwsgi_params;
        uwsgi_pass      unix:/run/uwsgi/protrack.sock;
    }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    include snippets/ssl-protrack.by.conf;
    include snippets/ssl-params.conf;
    server_name www.protrack.by;
    return 301 $scheme://protrack.by$request_uri;

}

But it doesnt work

Show the output of:

grep -i include /etc/nginx/nginx.conf

And, what is the full path to your snippets conf?

You’ll also need to move your WSGI handler and other configuration into your new SSL host.

/etc/nginx/sites-available/protrack

server {
    listen 80;
    listen [::]:80;
    server_name protrack.by www.protrack.by;
    return 301 https://protrack.by$request_uri;
}

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name www.protrack.by;
        include snippets/ssl-protrack.by.conf;
        include snippets/ssl-params.conf;
        return 301 https://protrack.by$request_uri;
}

server {
        # SSL configuration

        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        include snippets/ssl-protrack.by.conf;
        include snippets/ssl-params.conf;

        root /var/www/html;

        server_name protrack.by;

        location = /favicon.ico { access_log off; log_not_found off; }
        location /static/ {
            root /home/gk/protrack;
        }

        location / {
            include         uwsgi_params;
            uwsgi_pass      unix:/run/uwsgi/protrack.sock;
        }

        location ~ /.well-known {
            allow all;
            root /var/www/html;
        }

        location ~ /\.ht {
            deny all;
        }
}

Currently, you’re only showing the naked root of /var/www/html and it’s possible something weird in there is causing the redirect loop.

include /etc/nginx/modules-enabled/.conf;
include /etc/nginx/mime.types;
include /etc/nginx/conf.d/
.conf;
include /etc/nginx/sites-enabled/*;

@Lepiloff,

include /etc/nginx/modules-enabled/.conf;
include /etc/nginx/mime.types;
include /etc/nginx/conf.d/.conf;
include /etc/nginx/sites-enabled/*; 

You are showing the conf of your site located in /etc/nginx/sites-available/protrack but nginx is not loading this file. Copy the conf file protrack from sites-available to sites-enabled.

I don’t know if you have problems to copy/paste but are you sure you don’t have *.conf instead of .conf in modules-enabled and conf.d ?

Also, you didn’t post the full path to your snippets dir.

/etc/nginx/snippets/ssl-protrack.by.conf - this way you mean?

Yes, ok, that is fine, nginx should load them.

Yes, I write your setting in my file and it work now!
Thank you all for your help!

1 Like

Tell me if I need the file / etc / nginx / sites-available / default or this is the basic setting that can be deleted on the working project?

That should be safe as long as you move the default_server directive from there to both listen 80 lines in your vhost configuration.

You really helped me a lot. Many thanks

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.