XF 2.0 SSL Issues In NGINX

HortonX25

HortonX25

Member
So I've started by getting XF 2 working on Nginx without SSL, all fine and dandy.

So I decide to switch, this being what is put in nginx

NGINX: 
http {

      server {


      listen 443 ssl;


        server_name frozenincarbonite.org;
        ssl_certificate /root/bundle.crt;
        ssl_certificate_key /root/frozenincarbonite.org.key;

       location / {
          root /data/www;

          try_files $uri $uri/ /index.php?$uri&$args;





    }
}

I then attempt to run it, but I get this error

NGINX: 
500 Internal Server Error

I go to the nginx error log and I get this

NGINX: 
2018/07/11 12:18:55 [error] 4797#4797: *104647 rewrite or internal redirection cycle while internally redirecting to "/index.php", client: 109.151.59.135, server: frozenincarbonite.org, request: "GET /favicon.ico HTTP/1.1", host: "www.frozenincarbonite.org", referrer: "https://www.frozenincarbonite.org/"

Any clue? As this only seems to occur if I'm on HTTPS, HTTP works fine.
 
Sort by date Sort by votes
Mouth said:
It would seem your OP is not your entire http and server conf blocks, I don't see anything within that would cause you error.
Click to expand...
Lemmie drop the default configuration in, that seems to be effecting things as well

NGINX: 
##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    # SSL configuration
    #
    #listen 443 ssl default_server;
    # listen [::]:443 ssl default_server;
    #
    # Note: You should disable gzip for SSL traffic.
    # See: https://bugs.debian.org/773332
    #
    # Read up on ssl_ciphers to ensure a secure configuration.
    # See: https://bugs.debian.org/765782
    #
    # Self signed certs generated by the ssl-cert package
    # Don't use them in a production server!
    #
    # include snippets/snakeoil.conf;

    root /var/www/html/upload;



    # Add index.php to the list if you are using PHP
    index index.php index.html index.htm index.nginx-debian.html;

    server_name _;

    location / {
        # First attempt to serve request as file, then
        # as directory, then fall back to displaying a 404.
        try_files $uri $uri/ /index.php?$uri&$args;
    }

    # pass PHP scripts to FastCGI server
    #
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
    #
    #    # With php-fpm (or other unix sockets):
        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include fastcgi_params;
    #    # With php-cgi (or other tcp sockets):
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #    deny all;
    #}
}
 
Upvote 0 Downvote
We need your entire configuration, from nginx.conf on down.

The snippet you posted in your first post isn't even functional. Are you actually loading that and not something else?
 
Upvote 0 Downvote
Can you do a nginx -t to see if it prints any errors?
And also nginx -V (capital) to see if it has the https/ssl modules running? It should have --with-http_ssl_module

That first snippet you have has valid blocks, but leads me to believe this is not the entire configuration (error and access logs are not defined, no ssl protocols defined, no includes for per site .conf files). Did you make this file yourself?
 
Upvote 0 Downvote
Nicky Vermeersch said:
Can you do a nginx -t to see if it prints any errors?
And also nginx -V (capital) to see if it has the https/ssl modules running? It should have --with-http_ssl_module

That first snippet you have has valid blocks, but leads me to believe this is not the entire configuration (error and access logs are not defined, no ssl protocols defined, no includes for per site .conf files). Did you make this file yourself?
Click to expand...
Ah no, that isn't my entire snippet.

Here's my entire one

NGINX: 
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
    # multi_accept on;
}

http {

      server {


      listen 443 ssl;


        server_name frozenincarbonite.org;
        ssl_certificate /etc/ssl/certs/bundle.crt;
        ssl_certificate_key /etc/ssl/private/frozenincarbonite.org.key;

       location / {
          root /data/www;

          try_files $uri $uri/ /index.php?$uri&$args;





    }
}



    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # SSL Settings
    ##

    ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}


#mail {
#    # See sample authentication script at:
#    # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#    # auth_http localhost/auth.php;
#    # pop3_capabilities "TOP" "USER";
#    # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#    server {
#        listen     localhost:110;
#        protocol   pop3;
#        proxy      on;
#    }
#
#    server {
#        listen     localhost:143;
#        protocol   imap;
#        proxy      on;
#    }
#}

As for nginx -t, I get :
nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

and nginx -V

nginx -V
nginx version: nginx/1.10.3
built with OpenSSL 1.1.0f 25 May 2017
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -fdebug-prefix-map=/build/nginx-2tpxfc/nginx-1.10.3=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,-z,now' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit --with-ipv6 --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_xslt_module=dynamic --with-stream=dynamic --with-stream_ssl_module --with-mail=dynamic --with-mail_ssl_module --add-dynamic-module=/build/nginx-2tpxfc/nginx-1.10.3/debian/modules/nginx-auth-pam --add-dynamic-module=/build/nginx-2tpxfc/nginx-1.10.3/debian/modules/nginx-dav-ext-module --add-dynamic-module=/build/nginx-2tpxfc/nginx-1.10.3/debian/modules/nginx-echo --add-dynamic-module=/build/nginx-2tpxfc/nginx-1.10.3/debian/modules/nginx-upstream-fair --add-dynamic-module=/build/nginx-2tpxfc/nginx-1.10.3/debian/modules/ngx_http_substitutions_filter_module
 
Upvote 0 Downvote
HortonX25 said:
Here's my entire one
Click to expand...
By "entire one" confirming it's your /etc/nginx/nginx.conf file?

HortonX25 said:
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
Click to expand...
This. Highly likely something within these files that are being loaded, and/or any includes they may contain, is causing your "rewrite or internal redirection cycle while internally redirecting" error.

https://xenforo.com/community/threads/friendly-urls-with-nginx-throwing-404s.149908/post-1265455 is a similiar example of an incorrect config causing the same error message.
 
Last edited:
Upvote 0 Downvote
Mouth said:
By "entire one" confirming it's your /etc/nginx/nginx.conf file?


This. Highly likely something within these files that are being loaded, and/or any includes they may contain, is causing your "rewrite or internal redirection cycle while internally redirecting" error.

https://xenforo.com/community/threads/friendly-urls-with-nginx-throwing-404s.149908/post-1265455 is a similiar example of an incorrect config causing the same error message.
Click to expand...
it is

Ok, nothing in the first folder.

The second folder loads the "default config", which I've linked above.
 
Upvote 0 Downvote
HortonX25 said:
The second folder loads the "default config", which I've linked above.
Click to expand...

HortonX25 said:
NGINX: 
    # pass PHP scripts to FastCGI server
    #
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
    #
    #    # With php-fpm (or other unix sockets):
        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include fastcgi_params;
    #    # With php-cgi (or other tcp sockets):
    }
Click to expand...

In that case, one or both of the includes above are your issue. What are their contents?

root /var/www/html/upload; seems unusual too. Does it exist, and have the correct permissions for the user nginx is running under?
 
Upvote 0 Downvote
Mouth said:
In that case, one or both of the includes above are your issue. What are their contents?

root /var/www/html/upload; seems unusual too. Does it exist, and have the correct permissions for the user nginx is running under?
Click to expand...
All readable.

fastcgi-php.conf is

NGINX: 
# regex to split $uri to $fastcgi_script_name and $fastcgi_path
fastcgi_split_path_info ^(.+\.php)(/.+)$;

# Check that the PHP script exists before passing it
try_files $fastcgi_script_name =404;

# Bypass the fact that try_files resets $fastcgi_path_info
# see: http://trac.nginx.org/nginx/ticket/321
set $path_info $fastcgi_path_info;
fastcgi_param PATH_INFO $path_info;

fastcgi_index index.php;
include fastcgi.conf;

fastcgi_params is

NGINX: 
fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;

fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;
fastcgi_param  REQUEST_SCHEME     $scheme;
fastcgi_param  HTTPS              $https if_not_empty;

fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;

fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param  REDIRECT_STATUS    200;
 
Upvote 0 Downvote
Looks ok, the only thing I have mixed feelings about is the root you declared inside the block for location /
I'm not an expert on nginx, but I think it has to be set outside that block, and in the server block, in this case:

Code: 
http {

      server {


      listen 443 ssl;
      root /data/www;
      server_name frozenincarbonite.org;
      ssl_certificate /etc/ssl/certs/bundle.crt;
      ssl_certificate_key /etc/ssl/private/frozenincarbonite.org.key;

      location / {
          try_files $uri $uri/ /index.php?$uri&$args;
    }
}
 
Upvote 0 Downvote
Nicky Vermeersch said:
Looks ok, the only thing I have mixed feelings about is the root you declared inside the block for location /
I'm not an expert on nginx, but I think it has to be set outside that block, and in the server block, in this case:

Code: 
http {

      server {


      listen 443 ssl;
      root /data/www;
      server_name frozenincarbonite.org;
      ssl_certificate /etc/ssl/certs/bundle.crt;
      ssl_certificate_key /etc/ssl/private/frozenincarbonite.org.key;

      location / {
          try_files $uri $uri/ /index.php?$uri&$args;
    }
}
Click to expand...
Did that and it's still not working. :|

Gahhhh might end up switching to apache if this isn't fixed.
 
Upvote 0 Downvote
You must log in or register to reply here.

Similar threads

rkxh
Member page inaccessible NGINX - Friendly URLs
Replies
9
Views
443
Paul B
P
R
  • Question Question
XF 2.2 NGINX Windows Fresh Install
Replies
6
Views
395
Paul B
P
gldtn
Redirection on inline moderation
Replies
4
Views
547
specials
S
Sprisa
  • Solved
Nginx help
Replies
8
Views
999
TPerry
TPerry
ekool
Simple redirect in nginx or xenforo?
Replies
4
Views
780
Nookster
Nookster
Back
Top Bottom