ubuntu - Nginx 重定向 301 非 ssl www 到 ssl www 无法正常工作

Question

这种情况很少见:

我们正在使用 nginx 版本:nginx/1.10.3 (Ubuntu)

在我们的网站中，以下重定向有效:

http://example.net -> https://www.example.net [WORKING]
https://example.net -> https://www.example.net [WORKING]

但是，这个重定向根本不起作用:

http://www.example.net -> https://www.example.net [NOT WORKING]

这是我们的配置:

server {
    listen  80;
    listen  [::]:80;
    server_name     www.example.net;
    return 301 https://www.example.net$request_uri;
}

server {
    listen 80;
    listen [::]:80;
    server_name    _;
    return         301 https://www.example.net$request_uri;
}

server {
    listen 443;
    listen [::]:443;
    server_name    example.net;
    return         301 https://www.example.net$request_uri;
}

server {
    listen 443 default_server ssl http2;
    listen [::]:443 default_server ssl http2;
    server_name www.example.net;
    server_tokens off;
    more_set_headers 'Server: EMET';

    ssl    on;
    ssl_certificate    /etc/letsencrypt/live/example.net/fullchain.pem;
    ssl_certificate_key   /etc/letsencrypt/live/example.net/privkey.pem;

    ssl_dhparam /etc/ssl/certs/dhparam.pem;

    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers on;
    ssl_ecdh_curve  secp384r1;
    ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:ECDH+AESGCM:ECDH+AES256:DH+AESGCM:DH+AES256:!RS$

    ssl_session_cache shared:TLS:2m;

    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;

    add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";

    root /var/www/html/public;

    index index.php;

    location / {
            try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
           try_files $uri /index.php =404;
           fastcgi_split_path_info ^(.+\.php)(/.+)$;
           fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
           fastcgi_index index.php;
           fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
           include fastcgi_params;
    }

}

事实上，我们执行 curl -sv http://www.example.net 似乎它命中了 https 服务器 block 。我知道这是因为，正如您在上面的配置中看到的那样，在 nginx 中，我仅为 https://www.example.net 配置了带有字符串“EMET”的服务器 header 。领域。但是，当我执行 curl -sv http://www.example.net 时，该字符串出现在服务器的应答中。

curl -sv http://www.example.net/
*   Trying 54.85.198.227...
* TCP_NODELAY set
* Connected to www.example.net (54.85.198.227) port 80 (#0)
> GET / HTTP/1.1
> Host: www.example.net
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Date: Thu, 19 Apr 2018 19:50:31 GMT
< Content-Type: text/html; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Cache-Control: no-cache, private
< Server: EMET
< Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
< X-Frame-Options: DENY
< X-XSS-Protection: 1; mode=block

非常感谢您的帮助。

最好的问候，

Answer 1

经过几天的测试，我找到了解决这个问题的简单方法:

1. 我配置了 Amazon ELB
2. 使用重定向 HTTP -> HTTPS 设置 Cloudfront 分配
3. 更新了域的 Route53 DNS 条目。
4. 一切正常，来自 http://www.example.net -> https://www.example.net 的重定向现在正常工作，其余重定向都没有问题.