Configuring Nginx to use HSTS with an Automatic HTTPS Redirect

Since implementing HSTS and an HTTPS redirect properly was trickier than I'd imagined, I decided to write my own guide on how to do it. I'll also explain how to configure Nginx to use OSCP Stapling and IPv6 since I worked on getting both of them working at around the same time as I got the proper HTTPS redirect working.

Preface

Very recently, I decided to move my blog from Rackspace Cloud Files to a VPS at DigitalOcean. While the pricing for Cloud Files was very agreeable, you really did only get what you pay for:

Extremely high latency (500-1500 ms)
No support for TLS (SSL) on custom domains
No way to have separate TTL and browser cache durations on objects

These might have been acceptable trade-offs if I were hosting a large, million-views-per-day website and only used Cloud Files for images, documents, and other static content, but I'm not, and these issues really started to bug me after a while.

Since I had about $100 of unused DigitalOcean credit, I decided to see how the blog would perform on their lowest-tier VPS running CentOS with Nginx. To my surprise, pages loaded much faster and with significantly less latency than on Cloud Files. I thought this was incredible and that the performance more than justified DigitalOcean's relatively-high pricing ($5/mo. for 512 MB RAM, 20 GB RAID 10 SSD, and 1 CPU core), so I decided then to stay with them until my credit runs out in 20 months.

Now that I was no longer on Cloud Files, I decided I'd finally implement HTTPS on my blog. On top of that, though, I wanted to implement HTTP Strict Transport Security since it's a really cool technology that helps prevent sslstrip-style man-in-the-middle attacks. Of course, while I don't believe anyone would ever consider my blog important enough to attack, there have been reported instances of Internet Service Providers injecting ads into plaintext-HTTP webpages and I want to ensure that the content my blog readers see is the content I posted on it.

HTTPS and HSTS on Nginx

To start, I used the Mozilla SSL Configuration Generator to create a nice base config file for Nginx. Because I want as many people to securely view my blog as possible, I chose to use the "Intermediate" list of ciphers. To generate my DH paramaters, I followed the steps on this page. To enable HSTS, I added add_header Strict-Transport-Security "max-age=31536000"; to each HTTPS server block in the config file (adding an HSTS header to plain HTTP responses violates the HSTS specification).

For my specific setup, I want people to automatically get redirected to the www subdomain if they try to go to http(s)://cyrozap.com and for them to get redirected to HTTPS if they try to go to http://www.cyrozap.com. Finally, an HSTS header should be added to https://cyrozap.com so the browser knows not to try the HTTP link in case that redirect gets intercepted by an SSL-stripper. To do all of that, I used these simple configuration blocks:

server{
    listen 80;
    listen [::]:80;
    server_name cyrozap.com www.cyrozap.com;
    return 301 https://$host$request_uri;
}

The block above handles the HTTP->HTTPS redirect for both the main domain and the www subdomain. Essentially, all it does is listen for any connections to http://cyrozap.com or http://www.cyrozap.com and redirects them to https://cyrozap.com and https://www.cyrozap.com, respectively.

server{
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name cyrozap.com;
    add_header Strict-Transport-Security "max-age=31536000";
    return 301 https://www.$host$request_uri;
}

This block only handles connections to https://cyrozap.com. Its purpose is to add an HSTS header to the root domain and then immediately redirect it to the www subdomain. If I skipped using this block, browsers that had only connected to http://cyrozap.com in the past would always try to connect to that first, making them vulnerable to an SSL-stripping MitM.

OCSP Stapling

OCSP Stapling turned out to be more difficult to enable HSTS. To do it in Nginx, you need to add something that looks like this to your main server config block:

ssl_stapling               on;
ssl_stapling_verify        on;
ssl_trusted_certificate    /etc/nginx/startssl.stapling.crt;

resolver 8.8.8.8 8.8.4.4;
resolver_timeout 5s;

The tricky thing here is the ssl_trusted_certificate variable. You do not set that to your TLS certificate's CA certificate. Instead, you need to generate a certificate chain containing all the certificates leading up to the one that signs the OCSP response. Since I use the StartCom Class 1 CA, I tried using the certificate from this blog post, but it didn't work for me (I kept getting the kind of errors seen here). To fix it, I just tried different combinations of Root CA + Intermediate CA StartCom certs until I no longer got the OCSP verification failure messages. To make sure I don't somehow lose this certificate, I've reproduced it below:

IPv6 with TLS on Nginx

This final part was a little confusing, but I eventually figured it out. Since DigitalOcean supports IPv6 in the datacenter my VPS is in, I decided I'd take advantage of that feature and get my blog to work with it. After adding the necessary AAAA records to my domain, I needed to configure Nginx to listen on all IPv6 addresses (it doesn't by default). However, even after adding the listen [::]:443 ssl; and listen [::]:80; statements to the proper server configuration blocks, IPv6 still did not work properly. After some reading, it seems that the default listening ports need to be modified in the main Nginx config file as well (/etc/nginx/nginx.conf), not just the included config file for the specific site. In the only active server config block in that file, I modified the single listen 80; statement to look like this:

listen       80 default_server;
listen       [::]:80 ipv6only=on default_server;

After adding those lines, everything seemed to work as it should, even with multiple TLS and non-TLS virtual hosts.

Cyrozap's Tech Projects

Computers. Circuits. Code.

Configuring Nginx to use HSTS with an Automatic HTTPS Redirect

Preface

HTTPS and HSTS on Nginx

OCSP Stapling

IPv6 with TLS on Nginx

Comments