# Forcing SSL;

**URL:** <https://www.ruby-forum.com/t/forcing-ssl/202901>\
**Category:** NGINX\
**Created:** [February 8, 2011, 5:05pm UTC](https://www.ruby-forum.com/t/forcing-ssl/202901 "2011-02-08T17:05:40Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [February 8, 2011, 5:05pm UTC](https://www.ruby-forum.com/t/forcing-ssl/202901/1 "2011-02-08T17:05:40Z")

</div>

What is the best way to force all connections to use SSL?

if($scheme == ‘http’)…

redirect to https://

---

<div class="post-metadata">

**Author:** ![elegant](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ab097/32.png) [@elegant](https://www.ruby-forum.com/u/elegant)\
**Post date:** [February 8, 2011, 5:08pm UTC](https://www.ruby-forum.com/t/forcing-ssl/202901/2 "2011-02-08T17:08:11Z")

</div>

On Tue, Feb 8, 2011 at 5:05 PM, David J. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> What is the best way to force all connections to use SSL?

I use a separate server block like this:

server {  
server\_name [example.com](http://example.com);  
rewrite ^ https://example.com$request\_uri? break;  
}

---

<div class="post-metadata">

**Author:** ![elegant](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ab097/32.png) [@elegant](https://www.ruby-forum.com/u/elegant)\
**Post date:** [February 8, 2011, 5:34pm UTC](https://www.ruby-forum.com/t/forcing-ssl/202901/3 "2011-02-08T17:34:44Z")

</div>

On Tue, Feb 8, 2011 at 5:14 PM, David J. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Wouldn’t that create an infinite loop?

The server block I described is listening on port 80, https means port  
443. I can’t see how this would create a loop (and it never has on my  
server, where I use this block of code for a few domains).

-Luit

---

<div class="post-metadata">

**Author:** ![elegant](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ab097/32.png) [@elegant](https://www.ruby-forum.com/u/elegant)\
**Post date:** [February 8, 2011, 5:42pm UTC](https://www.ruby-forum.com/t/forcing-ssl/202901/4 "2011-02-08T17:42:16Z")

</div>

Yes good point;

You are right; I forgot about that;

---

<div class="post-metadata">

**Author:** ![elegant](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ab097/32.png) [@elegant](https://www.ruby-forum.com/u/elegant)\
**Post date:** [February 8, 2011, 5:44pm UTC](https://www.ruby-forum.com/t/forcing-ssl/202901/5 "2011-02-08T17:44:46Z")

</div>

On 8 Fev 2011 16h14 WET, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Wouldn’t that create an infinite loop?

No because they’re listening on different ports. No need for an  
if. Use two server blocks as suggested.

The server block for port 80 always does a permanent redirect do the  
the same server but listening on 443 with a SSL socket.

All the page processing happens at the server block for port 443.

server {  
## This is to avoid the spurious if for sub-domain name  
## rewriting. See [GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com · GitHub](http://wiki.nginx.org/Pitfalls#Server_Name).  
listen [::]:80;  
server\_name [example.com](http://example.com);  
rewrite ^ https://example.com$request\_uri? permanent;  
} # server domain rewrite.

server {  
listen [::]:443 ssl;  
server\_name [example.com](http://example.com);  
(…)  
}  
— appa

---

<div class="post-metadata">

**Author:** ![elegant](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ab097/32.png) [@elegant](https://www.ruby-forum.com/u/elegant)\
**Post date:** [February 8, 2011, 5:15pm UTC](https://www.ruby-forum.com/t/forcing-ssl/202901/6 "2011-02-08T17:15:12Z")

</div>

Wouldn’t that create an infinite loop?

shouldnt that be wrapped in an if statement?

if($scheme == http){

rewrite ^ https://example.com$request\_uri? break;

}