<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Here is a sample working configuration from one of my servers. Note that it uses separate `server` blocks for HTTP and HTTPS to make it easier to read.<div><br></div><div><font face="monospace, monospace">server {<br></font></div><div><div><font face="monospace, monospace"> listen 80;</font></div><div><font face="monospace, monospace"> listen [::]:80;</font></div><div><font face="monospace, monospace"> server_name <a href="http://server.example.com">server.example.com</a>;</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"> location ~ /\.well-known {</font></div><div><font face="monospace, monospace"> root /path/to/site;</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"><br></font></div><div><div><font face="monospace, monospace"> location / {</font></div><div><font face="monospace, monospace"> return 301 https://$host$request_uri;</font></div><div><font face="monospace, monospace"> }</font></div></div><div><font face="monospace, monospace">}</font></div></div><div><font face="monospace, monospace"><br></font></div><div><div><font face="monospace, monospace">server {</font></div><div><font face="monospace, monospace"> listen 443 ssl http2;<br></font></div><div><font face="monospace, monospace"> listen [::]:443 ssl http2;</font></div><div><div><font face="monospace, monospace"> server_name <a href="http://server.example.com">server.example.com</a>;</font></div><font face="monospace, monospace"><br class="gmail-Apple-interchange-newline"></font></div><div><font face="monospace, monospace"> root /path/to/site;<br></font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"> # rest of server config left our for brevity...</font></div><div><font face="monospace, monospace">}</font></div></div><div><br></div><div>Doing it this way has a side benefit if you have many sites running on a single server and you would like all of them to use LetsEncrypt and to be redirected to HTTPS.</div><div>You can change the HTTP `server` block to look like this:</div><div><br></div><div><div><font face="monospace, monospace">server {</font></div><div><font face="monospace, monospace"> listen 80 default_server;</font></div><div><font face="monospace, monospace"> listen [::]:80 default_server;</font></div><div><br></div><div><div><font face="monospace, monospace"> location ~ /\.well-known {</font></div><div><span style="font-family:monospace,monospace"> # ALL LetsEncrypt authorizations will be done in this single shared folder.</span></div><div><span style="font-family:monospace,monospace"> # This means you can issue the certificate using the LetsEncrypt command line</span></div><div><span style="font-family:monospace,monospace"> # and then create the `server` block which already includes the correct path to the certificate.</span> <font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"> root /var/www/html;</font></div><div><font face="monospace, monospace"> }</font></div><div><font face="monospace, monospace"><br></font></div><div><div><font face="monospace, monospace"> location / {</font></div><div><font face="monospace, monospace"> return 301 https://$host$request_uri;</font></div><div><font face="monospace, monospace"> }</font></div></div></div><div><span style="font-family:monospace,monospace">}</span><br></div></div><div><br></div><div>You then only need to create HTTPS `server` blocks for each site, which makes your configuration much simpler.</div><div><br></div><div>Moshe</div><div><br clear="all"><div><div dir="ltr" class="gmail_signature"><div dir="ltr">--<br>Moshe Katz<br>-- <a href="mailto:kohenkatz@gmail.com" target="_blank">kohenkatz@gmail.com</a><br>-- +1(301)867-3732</div></div></div><br></div></div></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Sun, Dec 2, 2018 at 5:09 PM Moshe Katz <<a href="mailto:kohenkatz@gmail.com">kohenkatz@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto">I believe you need to put the `return 301 ...` inside a location block too. Otherwise, it overrides all the location blocks.<div dir="auto"><br></div><div dir="auto">I'm on my phone now, but I'll try to share a sample file from one of my servers (that works as you want it) when I get back to my computer.</div><div dir="auto"><br></div><div dir="auto">Moshe</div><div dir="auto"><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Sun, Dec 2, 2018, 5:03 PM Mik J via nginx <<a href="mailto:nginx@nginx.org" target="_blank">nginx@nginx.org</a> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="m_-5603495848539027000m_-6100706546047295826ydp1a37a54cyahoo-style-wrap" style="font-family:Helvetica,Arial,sans-serif;font-size:16px">Hello,<br><div><br><div>I'd like to be able to offer let's encrypt in port 80 only and redirect everything else to port 443<br><div><br><span>server {<br> listen 80;<br> listen [::]:80;<br> listen 443;<br> listen [::]:443;<br> server_name <a href="http://www.mydomain.org" rel="nofollow noreferrer" target="_blank">http://www.mydomain.org</a> blog.<span><span><a href="http://mydomain.org" rel="noreferrer" target="_blank">mydomain.org</a></span></span>;<br> location ^~ /.well-known/acme-challenge { default_type "text/plain"; root /var/www/letsencrypt; }<br> location = /.well-known/acme-challenge/ { return 404; }<br> return 301 https:// <span><span><a href="http://mydomain.org" rel="noreferrer" target="_blank">mydomain.org</a></span></span>;<br>}<br><br></span><div>My problem is that everything is redirected and I cannot access a file in <span><span>/var/www/letsencrypt/<span><span>.well-known/acme-challenge</span></span><br></span></span><div><span><span>When I comment the return 301 it works but I loose the redirection.</span></span></div><div><br><div><div>It seems to me that nginx parses everything where I would expect it to stop at<br><div><span><span>location ^~ /.well-known/acme-challenge { default_type "text/plain"; root /var/www/letsencrypt; }</span><br></span><span></span><div><br>Does anyone know the trick ?<br></div></div></div><span><span></span></span></div></div></div></div></div></div></div></div>_______________________________________________<br>
nginx mailing list<br>
<a href="mailto:nginx@nginx.org" rel="noreferrer" target="_blank">nginx@nginx.org</a><br>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer noreferrer" target="_blank">http://mailman.nginx.org/mailman/listinfo/nginx</a></blockquote></div>
</blockquote></div>