Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

The redirect will be done in the HTTP protocol. HTTPS is HTTP wrapped inside a SSL connection, so if establishing the SSL connection fails because of a bad certificate there will never be the redirect to http://. So to make this working you have to use a certificate which the client accepts, e.g. matching the host name and issued by a trusted CA.

If you take off the ssl it will just start a normal non-ssl http server on port 443 but the browser will try to talk SSL and thus you get this error about record_too_long.