# Upgrading plain HTTP to HTTPS using STARTTLS

**URL:** <https://www.ruby-forum.com/t/upgrading-plain-http-to-https-using-starttls/243029>\
**Category:** NGINX\
**Created:** [August 16, 2015, 4:30pm UTC](https://www.ruby-forum.com/t/upgrading-plain-http-to-https-using-starttls/243029 "2015-08-16T16:30:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\
**Post date:** [August 16, 2015, 4:30pm UTC](https://www.ruby-forum.com/t/upgrading-plain-http-to-https-using-starttls/243029/1 "2015-08-16T16:30:10Z")

</div>

Hello,

I consider switching from Apache to Nginx (or using it as a reverse  
proxy to  
the Apache), but need to upgrade plain HTTP connections to HTTPS using  
the  
scheme defined in RFC 2817. Reason for this is a client software running  
on  
WiFi Captive Portals, which inserts an “Upgrade: TLS/1.x” request  
together  
with custom headers just in front of the encrypted request from a  
guest’s  
browser to our login server. In order for this scheme to work, the  
connection used for this kind of “ID request” to determine the hotspot  
in  
use and the remaining communication must not change over the upgrade,  
therefore redirection to the standard HTTPS port of the login server  
will  
not work.

So, I wonder how I can configure Nginx to get the same effect of  
Apache’s  
“SSLEngine: optional” setting? I did read the docs about the “starttls”  
setting in Nginx, but couldn’t find an example on how exactly to use  
this in  
a server block to achieve an upgrade to TLS.

Is it possible at all to configure Nginx this way? And if so, can I  
forward  
custom headers such as “X-HotspotID” if Nginx would be used as a proxy?

Thanx in advance!

Posted at Nginx Forum:

> **[Upgrading plain HTTP to HTTPS using STARTTLS](https://forum.nginx.org/read.php?2,261044,261044#msg-261044)**
>
> Hello, I consider switching from Apache to Nginx (or using it as a reverse proxy to the Apache), but need to upgrade plain HTTP connections to HTTPS using the scheme defined in RFC 2817. Reason for this is a client software running on WiFi Captive...

---

<div class="post-metadata">

**Author:** ![lbc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/ce73a5/32.png) [@lbc](https://www.ruby-forum.com/u/lbc)\
**Post date:** [August 17, 2015, 1:01pm UTC](https://www.ruby-forum.com/t/upgrading-plain-http-to-https-using-starttls/243029/2 "2015-08-17T13:01:34Z")

</div>

Hello!

On Sun, Aug 16, 2015 at 10:29:56AM -0400, lbc wrote:

> therefore redirection to the standard HTTPS port of the login server will  
> not work.
> 
> So, I wonder how I can configure Nginx to get the same effect of Apache’s  
> “SSLEngine: optional” setting? I did read the docs about the “starttls”  
> setting in Nginx, but couldn’t find an example on how exactly to use this in  
> a server block to achieve an upgrade to TLS.

The “starttls” directive is only available in mail proxy module,  
not for http. There is no support for RFC 2817 in nginx, as it’s  
not something used by known browsers.

Connections with Upgrade requests can be proxied to other servers  
though, so you can use nginx as a reverse proxy for such  
connections. Such approach is mostly used to proxy WebSocket  
connections, see [WebSocket proxying](http://nginx.org/en/docs/http/websocket.html) for  
configuration details.

> Is it possible at all to configure Nginx this way? And if so, can I forward  
> custom headers such as “X-HotspotID” if Nginx would be used as a proxy?

You can add arbitrary headers to requests nginx forwards to  
upstream servers, see [Module ngx\_http\_proxy\_module](http://nginx.org/r/proxy_set_header). You  
can also add response headers, see [Module ngx\_http\_headers\_module](http://nginx.org/r/add_header).

–  
Maxim D.

> **[nginx](http://nginx.org/)**

---

<div class="post-metadata">

**Author:** ![lbc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/ce73a5/32.png) [@lbc](https://www.ruby-forum.com/u/lbc)\
**Post date:** [August 17, 2015, 5:19pm UTC](https://www.ruby-forum.com/t/upgrading-plain-http-to-https-using-starttls/243029/3 "2015-08-17T17:19:12Z")

</div>

Dear Maxim,

thank you very much for the speedy answer!

Glad to here that the websocket approach could help. Will try this,  
since  
Nginx just rocks. 🙂

Have a nice day and best wishes,

Stefan (lbc)

Posted at Nginx Forum:

> **[Re: Upgrading plain HTTP to HTTPS using STARTTLS](https://forum.nginx.org/read.php?2,261044,261062#msg-261062)**
>
> Hello, I consider switching from Apache to Nginx (or using it as a reverse proxy to the Apache), but need to upgrade plain HTTP connections to HTTPS using the scheme defined in RFC 2817. Reason for this is a client software running on WiFi Captive...