nginx "ERR_TOO_MANY_REDIRECTS" after add ssl

Question

After i add Let's Encrypt certificate to my website with CertBot i get ERR_TOO_MANY_REDIRECTS when i try to visit the domain of my website.

some info :

-mywebsite build with django, nginx and gunicorn.

server {
server_name www.example.com example.com;

location = /favicon.ico { access_log off; log_not_found off; }
location /static/ {
    root /home/myproject;
}

location / {
    include proxy_params;
    proxy_pass http://unix:/run/gunicorn.sock;
}


listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = www.example.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


if ($host = example.com) {
    return 301 https://$host$request_uri;
} # managed by Certbot

listen 80;
server_name www.example.com example.com;
return 404; # managed by Certbot

}

/etc/letsencrypt/options-ssl-nginx.conf :-

# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file.

ssl_session_cache shared:le_nginx_SSL:1m;
ssl_session_timeout 1440m;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;

ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RS$

please tell me if you need any other code/info thanks

Note : i have read all the questions with the same problem and i still can't know what is wrong

score 10 · Answer 1 · edited Sep 04 '20 at 17:21

10

In case someone is using CloudFlare and having the same issue.

This fixed it: https://stackoverflow.com/a/60789055/3858492

In my case it was Cloudflare. I had to change to Full SSL encryption

edited Sep 04 '20 at 17:21

Michael Hampton

244,070
43
506
972

answered Sep 04 '20 at 10:51

Yacine al

113
1
5

1

indeed, `full-encryption` fixes redirect issues (using certbot/nginx/cloudflare/DO stack). – GG_Python Dec 29 '20 at 00:40

score 8 · Accepted Answer · edited Oct 02 '18 at 05:49

8

That's because you're redirecting all connections to https, even https connections, which means you create a redirect loop.

Change your config to

server {
    listen 80 default_server;
    server_name www.example.com example.com;

    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl default_server;
    server_name www.example.com example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


    location /favicon.ico { 
        access_log off; 
        log_not_found off; 
    }
    location /static/ {
        root /home/myproject;
    }

    location / {
        include proxy_params;
        proxy_pass http://unix:/run/gunicorn.sock;
    }
}

Though it would be good to know what your /etc/letsencrypt/options-ssl-nginx.conf includes.

Explanation:

Basically you need two "server" sections, one for port 80 and one for port 443. The port 80 (http) section only has the redirect in it and the 443 section holds the actual settings for your site (locations, roots, etc.) and the SSL settings (certificates, supported protocols, ciphers, etc.).

So when a client connects via http the server tells him to go to https instead and then the https part handles everything from there.

It's also a good idea to use indentation in your configs for better readability and easier bug fixing.

Note: The config I posted only fixed your redirect issue, I don't know if the actual config you had was valid for your case (gunicorn etc.). Normally you should also define an index and a root for your server like this:

root /home/website/mywebsite/public;
index index.html index.htm index.php;

edited Oct 02 '18 at 05:49

Jenny D

27,780
21
75
114

answered Sep 30 '18 at 19:16

Broco

1,999
13
21

thanks for your replay , i have update my question with the file you asked ... i get this problem when i update my config "/etc/nginx/sites-available/myproject" : `Job for nginx.service failed because the control process exited with error code. See "systemctl status nginx.service" and "journalctl -xe" for details.` when i run "systemctl status nginx.service" i get this `nginx: [emerg] a duplicate default server for 0.0.0.0:80 in /etc/nginx/sites-enabled/myproject:3` – DAMAR225 Oct 01 '18 at 00:01
when i open "/etc/nginx/sites-enabled/myproject" it has the same settings that i have add to "/etc/nginx/sites-available/myproject" – DAMAR225 Oct 01 '18 at 00:02
when i run "journalctl -xe" for details" i get this `-- The start-up result is RESULT. error: Could not load host key: /etc/ssh/ssh_host_ecdsa_key: Did not receive identification string from 88.212.254.105 port 55487 -- Unit nginx.service has begun starting up. nginx: [emerg] a duplicate default server for 0.0.0.0:80 in /etc/nginx/sites-enabled/myproject:3 nginx: configuration file /etc/nginx/nginx.conf test failed nginx.service: Control process exited, code=exited status=1 nginx.service: Failed with result 'exit-code'. Failed to start A high performance web server and a reverse proxy server` – DAMAR225 Oct 01 '18 at 00:03
**Note :** when i remove default_server from "listen 80 default_server;" nginx work but i still get the same probelm `ERR_TOO_MANY_REDIRECTS` – DAMAR225 Oct 01 '18 at 00:06
also i have change listen 80 default_server to listen 81 default_server it works but give me welcome to nginx – DAMAR225 Oct 01 '18 at 00:50
Do you have multiple sites on your server? – Broco Oct 01 '18 at 04:42
Just seen it, you already have a default site enabled in /etc/nginx/nginx.conf. Either disabled it there or remove the server part for port 80 in your site's conf and do your redirect in the nginx.conf – Broco Oct 01 '18 at 06:00
i had default file in /etc/nginx/sites-enabled/ and it has port 80 after i remove this file the part 80 problem solved but i still get `ERR_TOO_MANY_REDIRECTS` – DAMAR225 Oct 01 '18 at 16:09
Do you think this problem can be solved ? – DAMAR225 Oct 02 '18 at 03:53
Can you remove the "default_server" from the port 80 part? – Broco Oct 02 '18 at 05:03

nginx "ERR_TOO_MANY_REDIRECTS" after add ssl

2 Answers2