SSL on Nginx causes redirect loop - ruby-on-rails

Question

I'm trying to setup SSL on a Digital Ocean VPS using Nginx. My server conf is like so:
upstream unicorn {
server unix:/home/ubuntu/apps/example/shared/sock/unicorn.example.sock fail_timeout=0;
}
server {
listen 80;
server_name www.example.com example.com;
rewrite ^/(.*) https://example.com/$1 permanent;
}
server {
listen 443;
include example_ssl;
server_name www.example.com;
rewrite ^/(.*) https://example.com/$1 permanent;
}
server {
listen 443;
include example_ssl;
server_name example.com;
root /home/ubuntu/apps/example/current/public;
try_files $uri/index.html $uri #unicorn;
location #unicorn {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect off;
proxy_pass http://unicorn;
}
location ~ ^/(assets)/ {
gzip_static on;
expires max;
add_header Cache-Control public;
#add_header Last-Modified "";
#add_header ETag "";
}
error_page 500 502 503 504 /500.html;
client_max_body_size 4G;
keepalive_timeout 60;
}
The ssl info is in example_ssl:
ssl on;
ssl_certificate /etc/nginx/ssl/example.com.crt;
ssl_certificate_key /etc/nginx/ssl/example.com.key;
ssl_session_timeout 10m;
ssl_ciphers "AES256+EECDH:AES256+EDH";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
This is causing an endless redirect loop. Http requests are redirected to HTTPS as expected but all tries to https://example.com are being redirected back to HTTP.
I can't seem to figure out why the HTTPS requests are being redirected. I checked my SSL cert by going to www.digicert.com and everything came back saying it was successfully installed.
When I try from my terminal:
openssl s_client -connect example.com:443
I get the following error:
verify error:num=20:unable to get local issuer certificate
The cert I got from my client did not contain the intermediate certs, but from what I understand this should still work when trying to access the site from the browser.
If I change the server block to only listen for 80 and not use SSL the site is able to load successfully, but I need to use SSL only.
Also, this is hosting a Rails app with Unicorn web server. My unicorn.log is empty other than starting the webserver so am I correct that this is not touching my Rails configuration at all, just an issue with nginx/ssl cert configuration?
Thanks!

Answer 1

Try this:
upstream unicorn {
server unix:/home/ubuntu/apps/example/shared/sock/unicorn.example.sock fail_timeout=0;
}
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl;
include example_ssl;
server_name example.com;
root /home/ubuntu/apps/example/current/public;
try_files $uri/index.html $uri #unicorn;
location #unicorn {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect off;
proxy_pass http://unicorn;
}
location ~ ^/(assets)/ {
gzip_static on;
expires max;
add_header Cache-Control public;
#add_header Last-Modified "";
#add_header ETag "";
}
error_page 500 502 503 504 /500.html;
client_max_body_size 4G;
keepalive_timeout 60;
}
You will need to remove "ssl on;" from your ssl include file, that is for older versions of nginx. You might have to modify this if you are using multiple ssl on a single IP.