重定向到 https 时的 Nginx 重定向循环

Question

如果您有免费的 cloudflare 计划，或启用了 cloudflare，则会导致无限重定向循环。

我正在尝试使用 nginx 将 http 重定向到 https。我已经尝试过（几乎）一切。我试过正则表达式，301重定向和返回。

我不确定，但可能与配置文件有关。我使用 Let's Encrypt for SSL 和 php7.0.5-fpm 处理脚本。

server {
    listen 443 ssl;

    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

    location ~ /.well-known {
        allow all;
    }
}

server {
    listen 80 default_server;

    return 301 https://$http_host$request_uri;

    root /var/www/html;

    # Add index.php to the list if you are using PHP
    index index.php;

    server_name example.com;

    error_page 500 /500.html;
    error_page 404 /404.php;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}

编辑这里是命令ls -lah：

total 44K
drwxrwxrwx 6 root  root  4.0K Feb 28 22:12 .
drwxrwxrwx 3 root  root  4.0K Feb 20 21:19 ..
-rw-rw-rw- 1 rsudo rsudo  396 Feb 21 15:52 404.php
drwxrwxrwx 8 rsudo rsudo 4.0K Feb 21 15:50 assets
drwxrwxrwx 3 rsudo rsudo 4.0K Feb 21 15:48 backend
-rw-rw-rw- 1 rsudo rsudo  360 Feb 21 18:20 .htaccess
drwxrwxrwx 2 rsudo rsudo 4.0K Feb 21 15:49 includes
-rw-rw-rw- 1 root  root   612 Feb 28 22:12 index.nginx-debian.html
-rw-rw-rw- 1 rsudo rsudo   21 Feb 21 03:36 info.php
-rw-rw-rw- 1 rsudo rsudo 2.4K Feb 21 15:58 login.php
drwxrwxrwx 3 root  root  4.0K Feb 23 23:10 .well-known

配置：

server {
   listen 80;
   error_log /var/log/nginx/1.log;
   access_log /var/log/nginx/2.log;   

   server_name example.com;
   return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;

    access_log /var/log/nginx/1ssl.log;
    error_log /var/log/nginx/2ssl.log;

    # Add index.php to the list if you are using PHP
    index index.php;

    error_page 500 /500.html;
    error_page 404 /404.php;

    server_name example.com;

    root /var/www/html;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

    location ~ /.well-known {
            allow all;
    }

    location / {
        #So lonely...
    }

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}

Answer 1

如果您的目标是将所有 http 流量重写为 https，只需使用以下配置：

server {
   listen 80;
   server_name www.example.com;
   return 301 https://$server_name$request_uri;
}

这会从端口 80 永久重定向 (301) 到端口 443。因此，如果端口 80 不需要日志记录或其他任何操作，我们可以使用这部分。

对于 SSL 配置，请查看配置的以下部分：

server {
   listen 443 ssl;
   server_name www.example.com;

   ssl_certificate /path/to/ssl-bundle.crt;
   ssl_certificate_key /path/to/ssl-bundle.key;
   ssl_session_timeout 1d;
   ssl_session_cache shared:SSL:10m;
   # ssl_session_tickets off;

   # openssl dhparam -out dhparam.pem 2048
   # ssl_dhparam /etc/nginx/SSL/dhparams.pem;

   ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
   ssl_prefer_server_ciphers on;

   # commented out. Thanks to user Tom for the advice that Strict-Transport-Security may result in problems with subdomains.
   #add_header Strict-Transport-Security "max-age=15768000;includeSubdomains; preload";

   root /your/root/;
   index index.html index.htm index.php;

   client_max_body_size 20M;

   location / {
      # your custom config goes here for the "/" location.
   }

   location /doc/ {
       alias /usr/share/doc/;
       autoindex on;
       allow 127.0.0.1;
       deny all;
   }

   location ~/\.ht {
       deny all;
   }
 }

请注意：我建议生成至少 2048 位的 DiffieHellman 参数，甚至更好的 4096。上述 SSL 配置将使您的网站在 SSLLabs 上至少获得 A 评级。

希望这会有所帮助。

编辑：更正了 ssl_ciphers 部分，因为原始答案中存在复制和粘贴问题。感谢 Jacob 指出这一点。

Answer 2

看起来它正在通过Let's Encrypt 配置 HTTPS。 关键是.well-known只能使用80端口，其他部分使用443处理。

我把我的配置示例放在了可以正常工作的地方

server {
  listen 80;
  server_name example.com;
  location /.well-known/ {
    ...
  }
  location / {
    rewrite     ^ https://$server_name$request_uri? permanent;
  }
}
server {
  listen 443 ssl;
  server_name example.com;
  root /var/www/html;
  ... # The rest of configs you previously put in 80 part
}