# How to redirect all SSL traffic?

**URL:** <https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619>\
**Category:** NGINX\
**Created:** [November 8, 2009, 4:44am UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619 "2009-11-08T04:44:03Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 8, 2009, 4:44am UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/1 "2009-11-08T04:44:03Z")

</div>

I have a SSL set up on [www.mydomain.com](http://www.mydomain.com)

How can I redirect traffic on [mydomain.com](http://mydomain.com) to [https://www.mydomain.com](https://www.mydomain.com)?

I’ve tried the following

```
server {
    listen 443 default;
    server_name _;
    rewrite ^/(.*) https://www.mydomain.com/$1 permanent;
}

server {
    listen 443 default;
    rewrite ^ https://www.mydomain.com$request_uri?;
}

```

both not working…

thank’s before

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 8, 2009, 4:50am UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/2 "2009-11-08T04:50:30Z")

</div>

On Sat, Nov 7, 2009 at 20:37, Glen L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I have a SSL set up on [www.mydomain.com](http://www.mydomain.com)
> 
> How can I redirect traffic on [mydomain.com](http://mydomain.com) to [https://www.mydomain.com](https://www.mydomain.com)?  
> server {  
> listen 443 default;

Try port 80…

server {  
listen 80;  
rewrite ^(.\*) [https://mydomain.com$1](https://mydomain.com$1) permanent;  
}

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 9, 2009, 6:34pm UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/3 "2009-11-09T18:34:30Z")

</div>

On Sun, Nov 8, 2009 at 15:25, Glen L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Ok ill try that.
> 
> Why we can’t use the same method for port 443?

I assumed [www.mydomain.com](http://www.mydomain.com) and [mydomain.com](http://mydomain.com) have the same ip address  
and hence will go to the same nginx instance. SSL only works with one  
ip (unless you are using TLS with the server name stuff) so the server  
{ listen 443; } gets traffic for both [www.mydomain.com](http://www.mydomain.com) and  
[mydomain.com](http://mydomain.com). But it needs to redirect when it does not have the www  
to [www.mydomain.com](http://www.mydomain.com) and also serve the real [www.mydomain.com](http://www.mydomain.com) page when  
you go to [www.mydomain.com](http://www.mydomain.com). Hence the difference.

Im sure there are other ways to do it, experiment a bit 🙂

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 9, 2009, 4:18pm UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/4 "2009-11-09T16:18:42Z")

</div>

On Sun, Nov 8, 2009 at 03:31, Glen L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

[please keep the mailing list cc’ed]

> Try port 80…

> > On port 80 is sucessfull. Is there any way to do that on port 443?

Ahh ok so you want [http://mydomain.com](http://mydomain.com) and [https://mydomain.com](https://mydomain.com) to go  
to [https://www.mydomain.com](https://www.mydomain.com).

Sure something like:  
server {  
listen 80;  
rewrite (^.\*) [https://www.mydomain.com$1](https://www.mydomain.com$1) permanent;  
}

# config for [https://www.mydomain.com](https://www.mydomain.com)

server {  
listen 443;  
…  
if ($host !~ www.mydomain.com) {  
rewrite ^(.\*) [https://www.mydomain.com$1](https://www.mydomain.com$1) permanent;  
}

}

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 9, 2009, 7:57pm UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/5 "2009-11-09T19:57:38Z")

</div>

I tried this, but still doesn’t works

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 10, 2009, 2:02am UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/6 "2009-11-10T02:02:53Z")

</div>

On Sun, Nov 08, 2009 at 05:23:02PM -0700, Alex H. wrote:

> to [www.mydomain.com](http://www.mydomain.com) and also serve the real [www.mydomain.com](http://www.mydomain.com) page when  
> you go to [www.mydomain.com](http://www.mydomain.com). Hence the difference.
> 
> Im sure there are other ways to do it, experiment a bit 🙂

Anyway,

```
   server {
       listen 443;
       server_name mydomain.com;
   }

   server {
       listen 443;
       server_name www.mydomain.com;
   }

```

should work as well as

if ($host !~ www.mydomain.com) {

however, using “if” is uneffective way.

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 10, 2009, 2:02am UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/7 "2009-11-10T02:02:53Z")

</div>

On Mon, Nov 09, 2009 at 08:49:56AM +0700, Glen L. wrote:

> I tried this, but still doesn’t works

What do you mean by “doesn’t work” ? Browser shows a warning about  
invalid  
certificate ? In this case you need two certificates: for  
“[www.domain.com](http://www.domain.com)”  
and “[mydomain.com](http://mydomain.com)” and you should configure servers on different IP  
addreses.  
Or you can use a certificate with two Subject Alternate Names for  
“[domain.com](http://domain.com)” and “[www.domain.com](http://www.domain.com)”. Then you may use the certificate in  
both server with single IP address.

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 10, 2009, 3:03am UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/8 "2009-11-10T03:03:09Z")

</div>

On Mon, Nov 9, 2009 at 3:11 PM, Glen L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> Yes I have a valid ssl for [www.mydomain.com](http://www.mydomain.com). I don’t have a license for [mydomain.com](http://mydomain.com)
> 
> That’s why I want to redirect all traffic goes to [mydomain.com](http://mydomain.com) to [www.mydomain.com](http://www.mydomain.com)

create default ssl block to rewrite everything to [www.mydomain.com](http://www.mydomain.com)

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 10, 2009, 4:26am UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/9 "2009-11-10T04:26:52Z")

</div>

Hello!

On Mon, Nov 09, 2009 at 08:11:23AM +0000, Glen L. wrote:

> Yes I have a valid ssl for [www.mydomain.com](http://www.mydomain.com). I don’t have a license for [mydomain.com](http://mydomain.com)
> 
> That’s why I want to redirect all traffic goes to [mydomain.com](http://mydomain.com) to [www.mydomain.com](http://www.mydomain.com)

As long as you have no valid cert for [mydomain.com](http://mydomain.com) - you can’t  
handle requests in this domain without warnings from browsers. No  
way.

Maxim D.

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 10, 2009, 2:23am UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/10 "2009-11-10T02:23:22Z")

</div>

Yes I have a valid ssl for [www.mydomain.com](http://www.mydomain.com). I don’t have a license for  
[mydomain.com](http://mydomain.com)

That’s why I want to redirect all traffic goes to [mydomain.com](http://mydomain.com) to  
[www.mydomain.com](http://www.mydomain.com)

Best Regards,

Glen L.

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 10, 2009, 4:32am UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/11 "2009-11-10T04:32:08Z")

</div>

My question is,

Is that posibble to redirect all the traffic to www?

Best Regards,

Glen L.

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 10, 2009, 4:35am UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/12 "2009-11-10T04:35:39Z")

</div>

On Mon, Nov 09, 2009 at 10:23:33AM +0000, Glen L. wrote:

> My question is,
> 
> Is that posibble to redirect all the traffic to www?

With the “\*.mydomain.com” certificate the answer is YES.

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 10, 2009, 4:49am UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/13 "2009-11-10T04:49:42Z")

</div>

On Mon, Nov 09, 2009 at 05:34:11PM +0700, Glen L. wrote:

> So I can’t use such a configuration
> 
> server {  
> listen 443;  
> rewrite (^.\*) [https://www.mydomain.com$1](https://www.mydomain.com$1) permanent; }
> 
> ?

The following configuration should work:

```
 server {
     listen 192.168.1.1:443;
     server_name mydomain.com;
     ssl on;
     ssl_certificate /path/to/wildcard.certifcate;
     ...
 }

 server {
     listen 192.168.1.1:443;
     server_name *.mydomain.com;
     ssl on;
     ssl_certificate /path/to/wildcard.certifcate;
     rewrite ^ https://www.mydomain.com$request_uri? permanent; }
 }

```

Please note, that you should use the same wildcard certifcate in both  
servers.

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 10, 2009, 4:41am UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/14 "2009-11-10T04:41:31Z")

</div>

So I can’t use such a configuration

server {  
listen 443;  
rewrite (^.\*) [https://www.mydomain.com$1](https://www.mydomain.com$1) permanent; }

?

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 11, 2009, 3:36pm UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/15 "2009-11-11T15:36:51Z")

</div>

## Igor S. Wrote:

> > ?  
> > }
> 
> > > Subject: Re: How to redirect all SSL traffic?
> > > 
> > > > That’s why I want to redirect all traffic
> > > 
> > > > Date: Mon, 9 Nov 2009 10:57:18  
> > > > shows a warning about  
> > > > may use the certificate in
> > > > 
> > > > > On Sun, Nov 8, 2009 at 03:31, Glen L.  
> > > > > Ahh ok so you want [http://mydomain.com](http://mydomain.com) and
> > > > > 
> > > > > # config for [https://www.mydomain.com](https://www.mydomain.com)
> 
> –  
> Igor S.  
> [Igor Sysoev](http://sysoev.ru/en/)

Some plain SSL certificates work with both www and non-www without being  
a wildcard certificate. I just learned that the $10/year PositiveSSL  
that I got free from domain registration at  
[http://www.namecheap.com/learn/ssl-certificates/free-positive-ssl-certificates.asp](http://www.namecheap.com/learn/ssl-certificates/free-positive-ssl-certificates.asp)  
has this feature, although they don’t list it on their website.

server {  
listen 443;  
server\_name [mydomain.com](http://mydomain.com);

rewrite ^ https://www.mydomain.com$request\_url permanent;

ssl on;  
ssl\_certificate /etc/ssl/certs/mydomain.com.crt;  
ssl\_certificate\_key /etc/ssl/private/mydomain.com.key;  
}

server {  
listen 443;  
server\_name [www.mydomain.com](http://www.mydomain.com);

ssl on;  
ssl\_certificate /etc/ssl/certs/mydomain.com.crt;  
ssl\_certificate\_key /etc/ssl/private/mydomain.com.key;

…  
}

Works fine with the cheapo PositiveSSL cert. It looks like some  
companies use the feature to upsell you to their premium cert:  
[http://www.geocerts.com/ssl/quicksslpremium](http://www.geocerts.com/ssl/quicksslpremium)

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,21109,22131#msg-22131](http://forum.nginx.org/read.php?2,21109,22131#msg-22131)

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 11, 2009, 4:04pm UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/16 "2009-11-11T16:04:23Z")

</div>

On Wed, Nov 11, 2009 at 09:27:22AM -0500, brianmercer wrote:

> > permanent; }  
> > /path/to/wildcard.certifcate;  
> > https://www.mydomain.com$request\_uri? permanent; }
> > 
> > > To: [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> > > With the “\*.mydomain.com” certificate the answer
> > > 
> > > > Date: Mon, 9 Nov 2009 13:17:43  
> > > > [mydomain.com](http://mydomain.com)
> > > > 
> > > > > -----Original Message-----
> > 
> > Subject Alternate Names for  
> > traffic?  
> > way to do that on port 443?
> > 
> > > > > > }  
> > > > > > }  
> > > > > > [Igor Sysoev](http://sysoev.ru/en/)  
> > > > > > server\_name [mydomain.com](http://mydomain.com);  
> > > > > > server\_name [www.mydomain.com](http://www.mydomain.com);
> 
> ssl on;  
> ssl\_certificate /etc/ssl/certs/mydomain.com.crt;  
> ssl\_certificate\_key /etc/ssl/private/mydomain.com.key;
> 
> …  
> }
> 
> Works fine with the cheapo PositiveSSL cert. It looks like some companies use the feature to upsell you to their premium cert: [http://www.geocerts.com/ssl/quicksslpremium](http://www.geocerts.com/ssl/quicksslpremium)

Yes, if you have just two names, you may use such certificate.  
BTW, in this case you may set it on http level:

http {

ssl\_certificate /etc/ssl/certs/mydomain.com.crt;  
ssl\_certificate\_key /etc/ssl/private/mydomain.com.key;

server {

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [November 11, 2009, 4:05pm UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/17 "2009-11-11T16:05:34Z")

</div>

right config:

> > rewrite ^ https://www.mydomain.com$request\_uri? permanent;

wrong config:

---

<div class="post-metadata">

**Author:** ![Glen\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/bbe5ce/32.png) [@Glen\_L](https://www.ruby-forum.com/u/Glen_L)\
**Post date:** [December 29, 2010, 7:24am UTC](https://www.ruby-forum.com/t/how-to-redirect-all-ssl-traffic/178619/18 "2010-12-29T07:24:34Z")

</div>

Things to do here:

```
* Select the “A redirection to a URL” option.
* Enter the https://yourdomain.com and then $S$Q. Remember, there’s

```

no trailing slash after the domain.  
\* Select “The exact URL entered above"”  
\* Select “A permanent redirection for this resource”  
\* Set Execute permission to None.  
\* You can select the same app pool as the original one.

> **[GeoTrust QuickSSL Premium Certificate | #1 DV SSL Security Provider](https://www.thesslstore.com/geotrust/quickssl-premium.aspx)**
>
> GeoTrust QuickSSL Premium SSL certificates are domain validated and mobile friendly. Secure your domain with a strong 256-bit encryption—View pricing.