NGINX Reverse Proxy acme-challenge HTTP to 404 Error

http-status-code-404lets-encryptnginxnginx-reverse-proxy

First sorry for my poor english^^

I tried to set up a reverse proxy, and it work fine.
Now i want to obtain a ssl certificate with letsencrypt and i failed^^

On the reverse proxy i creat a file 1234.txt to try connect to it.

I can connect to https://mysite/.well-known/acme-challenge/1234.txt, but i cannot on http://mysite/.well-known/acme-challenge/1234.txt i obtain an error 404.

Where i make a mistake on my nginx conf?

    upstream [MySite].com {
    server "[MySite].com";
}
server {
    listen 80;
    root /var/www/html/[MySite].com;
    
    rewrite ^(.*) https://$host$1 permanent;
    
    location ~/.well-known/ {
        allow all;
    }
}
server {
    listen 443 ssl;
    server_name [MySite].com;
    ssl_certificate /etc/nginx/ssl/mysite.crt;
    ssl_certificate_key /etc/nginx/ssl/mysite.depro.key;
    proxy_redirect off;
    
    location / {
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass https://X.X.X.X:8006;
        proxy_buffering off;
        client_max_body_size 0;
        proxy_connect_timeout 3600s;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        send_timeout 3600s;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    
    location ~/.well-known/ {
        allow all;
    }
}

Thanks a lot for reply,

Regards,

Best Answer

Good morning, After a lot of trying i manage to access to http. Yes! Thanks Richard, Here is the correct conf file:

upstream [MySite].com {
        server "[MySite].com";
}
server {
        listen 80;
        server_name [MySite].com;
        root /var/www/html/[MySite].com;
        location / {
                return 301 https://$host$request_uri;
        }

        location ~/.well-known {
                allow all;
                }
}
server {
        listen 443 ssl;
        server_name [MySite].com;
        ssl_certificate /etc/nginx/ssl/CERT.crt;
        ssl_certificate_key /etc/nginx/ssl/CERT.depro.key;
        proxy_redirect off;
        root /var/www/html/[MySite].com;
        location / {
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_pass https://IP_DISTANTE:8006;
                proxy_buffering off;
                client_max_body_size 0;
                proxy_connect_timeout 3600s;
                proxy_read_timeout 3600s;
                proxy_send_timeout 3600s;
                send_timeout 3600s;
                proxy_set_header Host $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
        }

        location ~/.well-known {
                allow all;
            }
}

Regards,

Related Solutions

Nginx proxy pass works for https but not http

I believe you need a separate server block for HTTP. For example:

server {
listen 80;

location / {
        proxy_redirect off;
        proxy_cache off;
        proxy_pass         http://127.0.0.1:5000;
        proxy_set_header   Host             $http_host;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
}
}

You would then remove listen 80; from the existing server block.

Nginx/Apache: set HSTS only if X-Forwarded-Proto is https

You could have multiple server blocks. So just add new server block for domains that need HSTS.

server {
    listen xx.xx.xxx.xxx:443 ssl default_server;

    # all ssl stuff
    # and other directives
}

server {
    listen xx.xx.xxx.xxx:443 ssl;
    server_name example.com other.example.com;

    # all ssl stuff
    # and other directives with HSTS enabled
}

Here first block will handle all https connections except example.com and other.example.com.

And you don't need ssl on directive if you have ssl flag in listen.

EDIT

There is another solution with only one server block:

map $scheme:$host $hsts_header {
    default "";
    https:example.com "max-age=31536000";
    https:other.example.com "max-age=31536000";
}

server {
    server_tokens off;

    listen xx.xx.xxx.xxx:80;
    listen xx.xx.xxx.xxx:443 ssl;

    ssl_certificate /etc/ssl/foo.crt;
    ssl_certificate_key /etc/ssl/private/foo.key;

    ssl_session_timeout 10m;

    # ... other ssl stuff

    location / {
        proxy_pass http://127.0.0.1:81;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header Host $host;
        add_header X-XSS-Protection "1; mode=block";
        add_header Strict-Transport-Security $hsts_header;
    }
}

We use map to define HSTS header value and use the fact, than nginx will not add header with empty value.

Best Answer

Related Solutions

Nginx proxy pass works for https but not http

Nginx/Apache: set HSTS only if X-Forwarded-Proto is https

Related Topic