Nginx将301个非ssl www重定向到ssl www没有正常工作。

Question

这是一个罕见的例子：

我们用的是nginx version: nginx/1.10.3 (Ubuntu)

在我们的网站上，以下重定向正在工作：

http://example.net -> https://www.example.net [WORKING]
https://example.net -> https://www.example.net [WORKING]

然而，这种重定向根本不起作用：

http://www.example.net -> https://www.example.net [NOT WORKING]

以下是我们的配置：

server {
    listen  80;
    listen  [::]:80;
    server_name     www.example.net;
    return 301 https://www.example.net$request_uri;
}

server {
    listen 80;
    listen [::]:80;
    server_name    _;
    return         301 https://www.example.net$request_uri;
}

server {
    listen 443;
    listen [::]:443;
    server_name    example.net;
    return         301 https://www.example.net$request_uri;
}

server {
    listen 443 default_server ssl http2;
    listen [::]:443 default_server ssl http2;
    server_name www.example.net;
    server_tokens off;
    more_set_headers 'Server: EMET';

    ssl    on;
    ssl_certificate    /etc/letsencrypt/live/example.net/fullchain.pem;
    ssl_certificate_key   /etc/letsencrypt/live/example.net/privkey.pem;

    ssl_dhparam /etc/ssl/certs/dhparam.pem;

    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers on;
    ssl_ecdh_curve  secp384r1;
    ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:ECDH+AESGCM:ECDH+AES256:DH+AESGCM:DH+AES256:!RS$

    ssl_session_cache shared:TLS:2m;

    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;

    add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";

    root /var/www/html/public;

    index index.php;

    location / {
            try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
           try_files $uri /index.php =404;
           fastcgi_split_path_info ^(.+\.php)(/.+)$;
           fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
           fastcgi_index index.php;
           fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
           include fastcgi_params;
    }

}

实际上，我们做的是curl -sv http://www.example.net，它似乎击中了https服务器块。我知道这是因为，正如您在上面的配置中所看到的，在nginx中，我只为https://www.example.net域配置了字符串"EMET“的服务器头。但是，当我执行curl -sv http://www.example.net时，字符串会出现在服务器的答案中。

curl -sv http://www.example.net/
*   Trying 54.85.198.227...
* TCP_NODELAY set
* Connected to www.example.net (54.85.198.227) port 80 (#0)
> GET / HTTP/1.1
> Host: www.example.net
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Date: Thu, 19 Apr 2018 19:50:31 GMT
< Content-Type: text/html; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Cache-Control: no-cache, private
< Server: EMET
< Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
< X-Frame-Options: DENY
< X-XSS-Protection: 1; mode=block

我非常感谢你的帮助。

诚挚的问候,

Answer 1

经过几天的测试，我找到了一个简单的解决方案：

1. 我配置了Amazon
2. 使用重定向HTTP -> HTTPS设置Cloudfront发行版
3. 更新了域的Route53 DNS条目。
4. 一切都运行得很好，http://www.example.net -> https://www.example.net的重定向现在正在正常工作，没有任何问题，就像重定向的其他部分一样。