nginx rewrite rules for only SSL - redirect

Question

I want to redirect evry traffic of a domain to to one target:
https://example.com
We want to change http to https and www to nonwww.
Nginx 1.8.1 is the server
This is the vhost:
server {
listen xxx.xxx.xxx.xxx:80;
listen xxx.xxx.xxx.xxx:443 ssl;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_certificate /www/clients/client1/web2/ssl/example.com.crt;
ssl_certificate_key /www/clients/client1/web2/ssl/example.com.key;
server_name example.com www.example.com;
root /var/www/example.com/web;
#This is a rewrite from www.example.com -> example.com
if ($http_host = "www.example.com") {
rewrite ^ $scheme://example.com$request_uri? permanent;
}
......
......
}
The Problem that we have is, that every redirects and rewrite rules we checked out, worked well for this three cases:
https://example.com --> is right target works
http://www.example.com --> https://example.com works
http://example.com --> https://example.com works
but
https://**www**.example.com ---> https://example.com don't works
In Browsers we see https://www.example.com instead the target SSL
domain https://example.com
In this case our SL Cert shows an "untrusted" - message
The configiguration of the vhost is preset by ISPConfig.
Has anybody the same experiences? And maybe a solution.

Answer 1

Your certificate is most likely only issued for example.com and is not valid for www.example.com. Redirections, like the one you have in your NGINX config, happen only after the TLS/ HTTPS handshake which is what your browser is complaining about.
You will need to request your certificate issuer to issue a new certificate that is valid for both example.com and www.example.com. Most issuers should have done this to begin with and do not charge any fees.

Answer 2

Here is what I have done with one my domain.
server {
listen 80 default_server;
listen [::]:80 default_server ipv6only=on;
return 301 https://$host$request_uri$is_args$args;
root /var/www/public_html;
index index.php index.html index.htm;
server_name domain.com www.domain.com;
add_header Strict-Transport-Security "max-age=31536000";
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
try_files $uri =404;
fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
}
location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg)$ {
expires 2d;
}
}
server {
listen 443;
add_header Strict-Transport-Security "max-age=31536000";
root /var/www/public_html;
index index.php index.html index.htm;
server_name domain.com www.domain.com;
ssl on;
ssl_certificate /etc/ssl/ssl-bundle.crt;
ssl_certificate_key /etc/ssl/myserver.key;
ssl_dhparam /etc/ssl/dhparams.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
#Disables all weak ciphers
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_prefer_server_ciphers on;
client_max_body_size 20M;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
try_files $uri =404;
fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
}
location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg)$ {
expires 30d;
}
}
By the way, This settings make my domain ssl as A+ in ssltestlab