NGINX http://example.com到https://www.example.com重寫，怎麼樣？

Question

我最近買了一個我想試用的SSL證書。我也是第一次創建了VPS服務器，經過許多艱苦和憤怒的管理，我成功地在Ubuntu 14.04上安裝了LEMP和NGINX，並且還安裝了SSL證書。我的網站是wknet.se。

現在，我想重寫網址：

---------------------------------------------------------------- 
|    From     |    To   | 
---------------------------------------------------------------- 
| http://wknet.se    | https://www.wknet.se | 
| http://wknet.se/index.php  | https://www.wknet.se | 
| http://www.wknet.se/index.php | https://www.wknet.se | 
| wknet.se      | https://www.wknet.se | 
| wknet.se/index.php    | https://www.wknet.se | 
| www.wknet.se/index.php   | https://www.wknet.se | 
| https://wknet.se    | https://www.wknet.se | 
| https://wknet.se/index.php  | https://www.wknet.se | 
---------------------------------------------------------------- 

許多試驗和錯誤，幾個毀滅性小時，我只有2重寫留給修復後：

---------------------------------------------------------------- 
|    From     |    To   | 
---------------------------------------------------------------- 
| https://wknet.se    | https://www.wknet.se | 
| https://wknet.se/index.php  | https://www.wknet.se | 
---------------------------------------------------------------- 

現在，我不知道如何解決它們！我已經Google和谷歌搜索，我已經測試了幾個很好的NGINX重寫規則，但我還沒有弄明白。

這是我第一次在NGINX上使用SSL，重寫規則等。

現在，這是我的服務器設置什麼樣子的wknet.se：

server { 
    listen 80 default_server; 
    listen [::]:80 default_server ipv6only=on; 

    add_header Strict-Transport-Security max-age=15768000; 
    return 301 https://www.wknet.se$request_uri; 
} 
server { 
    listen 443 ssl; 
    server_name www.wknet.se; 

    root /var/www/wknet.se/html; 
    index index.php index.html index.htm; 

    ssl_certificate /etc/nginx/ssl/SSL.CRT; 
    ssl_certificate_key /etc/nginx/ssl/KEY.KEY; 

    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; 
    ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM; 
    ssl_prefer_server_ciphers on; 

    error_page 404 /404.html; 
    error_page 500 502 503 504 /50x.html; 

    location/{ 
     try_files $uri $uri/ =404; 
    } 

    location = /50x.html { 
     root /usr/share/nginx/html; 
    } 

    location ~ \.php$ { 
     try_files $uri =404; 
     fastcgi_split_path_info ^(.+\.php)(/.+)$; 
     fastcgi_pass unix:/var/run/php5-fpm.sock; 
     fastcgi_index index.php; 
     include fastcgi_params; 
    } 
    location = /index { 
     rewrite ^/index\.(php)$ https://www.wknet.se/ permanent; 
    } 

    location ~ /\.ht { 
     deny all; 
    } 

    location = /favicon.ico { 
     log_not_found off; 
     access_log off; 
    } 

    location = /robots.txt { 
     allow all; 
     log_not_found off; 
     access_log off; 
    } 

    location ~ /\. { 
     deny all; 
     error_log off; 
     log_not_found off; 
    } 

    location ~* .(jpg|jpeg|png|gif|ico|css|js)$ { 
     log_not_found off; 
     expires 365d; 
    } 

    location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|png|gif|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ { 
     access_log off; 
     log_not_found off; 
     expires max; 
     add_header Pragma public; 
     add_header Cache-Control "public, must-revalidate, proxy-revalidate"; 
    } 

    location ~* \.(7z|ai|class|css|csv|ejs|eps|flv|html?|jar|jpe?g|js|json|lzh|m4a|m4v|mov|mp3|pdf|pict|pls|ps|psd|swf|tiff?|txt|webp)$ { 
     access_log off; 
     log_not_found off; 
     expires max; 
     add_header Pragma public; 
     add_header Cache-Control "public, must-revalidate, proxy-revalidate"; 
    } 
} 

如果有人可以幫助我我會很開心！此外，如果有人在我的服務器設置上有提示來進行一些改進，它也會幫助很多人，因爲我不知道我是否做得正確！

謝謝！

Answer 1

從example.com重定向到www.example.com你只需要創建一個單獨的服務器塊，並設置服務器名相應。在你的設置，你會怎麼做：

server { 
    listen 443 ssl; 
    server_name wknet.se; 

    ssl_certificate /etc/nginx/ssl/SSL.CRT; 
    ssl_certificate_key /etc/nginx/ssl/KEY.KEY; 

    # OBSOLETE: 
    # ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; 
    # ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM; 

    # Use currently secure protocols 
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; 
    ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4'; 

    ssl_prefer_server_ciphers on; 

    return 301 https://www.wknet.se$request_uri; 
} 

以上都將https://wknet.se/ ...請求重定向到https://www.wknet.se/ ...。

對於HTTPS你需要包括塊中的SSL證書鍵（或者你可以設置SSL證書。在你HTTP語句塊，如果所有的服務器都使用相同的設置）。

產生額外的配置

如果你想http://wknet.se/ ...重定向到http://www.wknet.se/ ... - 普通的HTTP請求到SSL HTTPS請求 - 添加端口監聽額外的服務器塊80和重定向到443端口：

server { 
    listen 80; 
    server_name *.wknet.se wknet.se; 
    return 301 https://www.wknet.se$request_uri; 
} 

以上將重定向http://wknet.se/ ...和像http://www.wknet.se/ ...或http://static.wknet.se/ ...等子域https://www.wknet.se/ ...任何請求。

2015年3月28日修訂註記

• 更新示例代碼使用安全的SSL協議。原始示例使用不推薦使用的SSLv3。根據目前的做法，我用更安全的設置替換了ssl_protocols和ssl_ciphers。