Nginx upstream https not proxing other pages

Question

Having odd situation, even don't know how to search in google, how to describe it...Anyway I'm using Nginx and proxy'ing https traffic to upstream server. Everything is fine with http (with others domains) but can't get it to work with https...

Here is my nginx config

upstream umarket { server 192.168.2.11:443; }

# Upstream
server {
    listen 80;
    listen 443 ssl http2;
    server_name  umarket.lt;

    error_log  /var/log/nginx/umarket.lt_error.log;

    add_header Strict-Transport-Security "max-age=31536000";

    ssl on;
    ssl_certificate             /etc/nginx/ssl/umarket.lt/umarket_lt_chained.crt;
    ssl_certificate_key         /etc/nginx/ssl/umarket.lt/server.key;
    ssl_session_cache           builtin:1000 shared:SSL:10m;
    ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers   on;

    proxy_redirect              off;
    proxy_buffering             off;
    proxy_set_header            Host $host;
    proxy_set_header            X-Real-IP $remote_addr;
    proxy_set_header            X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header            X-Forwarded-Proto https;
    proxy_next_upstream         error timeout invalid_header http_500 http_502 http_503 http_504;
    proxy_ssl_session_reuse     off;
    proxy_cache_bypass          $http_secret_header;
    proxy_ignore_headers        Set-Cookie;
    proxy_ignore_headers        Cache-Control;

    location = / {

        proxy_pass  $scheme://umarket;

    }

}

Here is what happening

As suggested I will not use ssl to upstream, hre what confgi looks like now, still same result...This is inside http block:

upstream umarket { server 192.168.2.11:80; }

proxy_redirect              off;
proxy_buffering             off;
proxy_set_header            Host $host;
proxy_set_header            X-Real-IP $remote_addr;
proxy_set_header            X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header            X-Forwarded-Proto http;
proxy_next_upstream         error timeout invalid_header http_500 http_502 http_503 http_504;
proxy_ssl_session_reuse     off;
proxy_cache_bypass          $http_secret_header;
proxy_ignore_headers        Set-Cookie;
proxy_ignore_headers        Cache-Control;

add_header                  X-Cache-Status  $upstream_cache_status;

server {
    listen *:80;
    server_name umarket.lt;
    rewrite ^(.*) https://$host$1 permanent;
}

server {
    listen 443 ssl http2;
    server_name  umarket.lt;

    error_log  /var/log/nginx/umarket.lt_error.log;

    add_header Strict-Transport-Security "max-age=31536000";

    ssl on;
    ssl_certificate             /etc/nginx/ssl/umarket.lt/umarket_lt_chained.crt;
    ssl_certificate_key         /etc/nginx/ssl/umarket.lt/server.key;
    ssl_session_cache           builtin:1000 shared:SSL:10m;
    ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers   on;

    location = / {

        proxy_pass  http://umarket;

    }

}

Also as mentioned, no need to secure front-end to back-end but must add proxy_set_header X-Forwarded-Proto $scheme; otherwise will fail. — RomkaLTU, Jun 23 '16 at 12:00

Alexander Tolkachev · Accepted Answer · 2016-06-23T11:48:31.390

0

Make two server sections for 80 and 443 ports. And use 80 port on upstream server, you already make SSL connection on nginx, there in no need to use SSL connection between frontend and backend.

Use something like this to forward all requests from http to https version of site.

server {
    listen 80;
    server_name umarket.lt;
    rewrite ^(.*) https://$host$1 permanent;
}

Solution: Also replace location = / to location /. It solve problem.

edited Jun 23 '16 at 11:48

answered Jun 23 '16 at 10:30

Alexander Tolkachev

4,608
3
14
23

Absolutely same results, trying to do this 2 days now. – RomkaLTU Jun 23 '16 at 11:10
@RomkaLTU could you show actual config? – Alexander Tolkachev Jun 23 '16 at 11:15
Updated post... – RomkaLTU Jun 23 '16 at 11:22
@RomkaLTU: replace **location = /** to **location /**. And bring back proxy params to server or location section. – Alexander Tolkachev Jun 23 '16 at 11:29
**there in no need to use SSL connection between frontend and backend.** - There absolutely is, you have spent the time securing the incoming data only to send data out in unsecured. – Drifter104 Jun 23 '16 at 11:40
Amazing, so basically problem was "location =/ " instead of "location /", however I still need https to backend don't know why, some resources refusing to load if http to backend. Also I will leave proxy params in http block as they are globals, don't want to repeat it in every server block. – RomkaLTU Jun 23 '16 at 11:43
@RomkaLTU i've updated answer. You cloud mark it as solution. – Alexander Tolkachev Jun 23 '16 at 11:48

Nginx upstream https not proxing other pages

1 Answers1