The dependable pattern is to terminate TLS at NGINX, keep an HTTP listener for ACME validation and redirects, proxy requests to your Rails application server, and tell Rails that the original request was HTTPS. In practice, that means a certificate and private key in an NGINX listen 443 ssl server block, an exception for /.well-known/acme-challenge/ on port 80, forwarding headers such as X-Forwarded-Proto https, and config.force_ssl = true in the production environment.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
How the HTTPS request path works
A browser connects to your hostname on TCP port 443. NGINX presents the certificate, completes the TLS handshake, decrypts the request, and forwards ordinary HTTP traffic over the local connection to Puma, Unicorn, or another Rails application server. Rails does not need to perform the public TLS handshake in this arrangement, but it must receive accurate proxy headers so it knows that the client originally used HTTPS.
As an Amazon Associate I earn from qualifying purchases.
Port 80 still has an important job. Certificate authorities using ACME HTTP-01 validation request a token under /.well-known/acme-challenge/. Your port-80 server must serve that path, while normal application requests receive a permanent redirect to the HTTPS URL. Removing port 80 entirely can prevent HTTP-01 issuance and renewal.
The examples below use example.com, www.example.com, an ACME webroot at /var/www/letsencrypt, and a Rails server listening on 127.0.0.1:3000. They are illustrative values; substitute the hostnames, filesystem paths, and upstream port used by your deployment.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prerequisites before changing NGINX
- Create DNS records for every hostname you will serve and point them to the NGINX server. Check both the apex name and any
wwwor API name that will appear in a certificate. - Allow inbound TCP ports 80 and 443 in the cloud firewall, security group, host firewall, and any load balancer in front of NGINX.
- Confirm that the Rails application server is listening on a local address and port, such as
127.0.0.1:3000, and that NGINX can reach it. - Choose an ACME webroot directory that NGINX can read and that your certificate client can write. The directory must be available while validation requests are made.
- Identify the account and group under which the NGINX master process runs. The certificate’s private key must be readable by that master process but not by ordinary users, as explained in the NGINX HTTPS documentation.
Choose certificate issuance and TLS topology
HTTP-01 or DNS-01 validation
| Method | What must be reachable | When it fits | Operational concern |
|---|---|---|---|
| HTTP-01 | Port 80 must serve the token at /.well-known/acme-challenge/. |
A host whose web server is publicly reachable on port 80. | Do not redirect or proxy the challenge location away from the ACME webroot. |
| DNS-01 | A temporary DNS challenge record must be created for the domain. | Deployments that cannot expose port 80 or that need wildcard certificates. | DNS credentials and propagation behavior become part of the renewal process; exact provider steps are not stated here. |
For HTTP-01, Certbot can write challenge files to the webroot used by the port-80 NGINX block. The Certbot documentation describes the validation and renewal workflow in its official guide. Regardless of method, keep a tested plan for renewing before the certificate expires.
Manual certificates versus automated renewal
| Approach | Advantages | Risks and required work |
|---|---|---|
| Manually managed certificate files | Useful when another system already issues certificates or policy requires an internal authority. | You must copy the new certificate and key into place, preserve permissions, validate NGINX, and reload it on every rotation. |
| Certbot-managed renewal | Renewal can run unattended and can renew files in a predictable live-directory layout. | You still need to verify the scheduler, preserve the ACME challenge path, test a renewal simulation, and reload NGINX after a successful renewal. |
TLS termination choices
| Design | Connection from client to NGINX | Connection from NGINX to Rails | Typical reason to choose it |
|---|---|---|---|
| TLS terminated at NGINX | HTTPS | HTTP on a protected local or private network | Simpler Rails proxying and certificate management when the upstream link is trusted. |
| End-to-end TLS | HTTPS | HTTPS | Required when policy demands encryption on the internal hop or traffic crosses an untrusted network. |
The configuration in this article uses the first design. If you encrypt the upstream as well, change proxy_pass to an HTTPS upstream and separately manage the upstream certificate validation; the public certificate directives shown here still belong to the NGINX HTTPS server block.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Place the certificate and protect the private key
NGINX needs the certificate chain and the corresponding private key. A common Certbot layout is:
/etc/letsencrypt/live/example.com/fullchain.pemfor the server certificate plus intermediates./etc/letsencrypt/live/example.com/privkey.pemfor the private key.
Those paths are examples, not universal requirements. Use the exact paths produced by your certificate authority or internal certificate process. The certificate can be readable by NGINX; the private key is a sensitive credential. Set ownership and mode so the NGINX master process can read it while unprivileged accounts cannot. Avoid placing a private key in the application repository, a world-readable directory, or a backup location with broader access than the live key.
If you copy files during renewal, replace the certificate and key as an atomic operation where practical, retain the matching pair, then run an NGINX configuration test before reloading. A certificate from one issuance paired with a private key from another will fail the handshake.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Build the NGINX server blocks
Port 80: ACME webroot and redirect
Create or edit the HTTP server block for every public name. The challenge location is deliberately more specific than the catch-all location, so the token is served from the webroot instead of redirected:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
server {
listen 80;
server_name example.com www.example.com;
location ^~ /.well-known/acme-challenge/ {
root /var/www/letsencrypt;
}
location / {
return 301 https://$host$request_uri;
}
}With this layout, a file placed at /var/www/letsencrypt/.well-known/acme-challenge/<token> is available at the matching public URL. Ensure the NGINX worker can read the directory and that another server, CDN, or load balancer is not intercepting port 80. The redirect keeps the original host and path while moving normal requests to HTTPS.
Port 443: certificate, protocol, and Rails proxy
Add an HTTPS server block that names the same hostnames and references the certificate and key:
server {
listen 443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://127.0.0.1:3000;
}
}The NGINX HTTPS documentation identifies the certificate and private key directives and documents TLS 1.2 and TLS 1.3 as modern protocol settings. Keep the fullchain.pem and privkey.pem pairing intact. If your application server uses a Unix socket or a different port, change only the proxy_pass target to match it.
Why each proxy header matters
Host $http_hostpreserves the hostname the browser requested. Rails uses that information when constructing absolute URLs and applying host-based routing.X-Forwarded-For $proxy_add_x_forwarded_forcarries the client address while retaining any forwarding chain already present.X-Forwarded-Proto httpstells Rails that the external request scheme was HTTPS even though NGINX speaks plain HTTP to a local upstream.
Omitting the scheme header is a common cause of redirect loops: Rails sees an HTTP request, force_ssl redirects it to HTTPS, and the next proxied request again appears to Rails as HTTP. The Rails ActionDispatch::SSL API explains that this middleware relies on the original request scheme.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Tell Rails to enforce HTTPS
In the production configuration, enable SSL enforcement:
# config/environments/production.rb
config.force_ssl = trueRails adds the ActionDispatch::SSL middleware when config.force_ssl = true. The middleware redirects HTTP requests and makes HTTPS the default URL protocol, as documented in the Rails configuration guide. Restart the Rails application after changing the environment configuration so the new setting is loaded.
NGINX and Rails must agree about the scheme. NGINX performs the public redirect and TLS handshake; Rails applies its own HTTPS policy and generates secure absolute URLs. The forwarded host and protocol therefore need to be set consistently on every proxy path, including health or mounted application locations that generate links.
Deployment procedure
- Publish DNS and open ports. Point each served hostname at the NGINX address and verify that TCP 80 and 443 reach this machine rather than an old server.
- Create the ACME webroot. Make
/var/www/letsencrypt(or your chosen directory), grant NGINX read access, and confirm that a test file can be fetched through/.well-known/acme-challenge/. - Obtain the certificate. With HTTP-01 and Certbot, use the webroot and every required DNS name. A representative command is:
certbot certonly --webroot
-w /var/www/letsencrypt
-d example.com
-d www.example.com- Install the NGINX blocks. Substitute the actual certificate paths, hostnames, ACME root, and Rails upstream address in the port-80 and port-443 examples.
- Enable Rails enforcement. Add
config.force_ssl = trueto the production environment and restart the Rails process. - Validate before applying. Run
nginx -t. Do not reload if the test reports a syntax error, missing file, invalid permission, or duplicate/conflicting server definition. - Reload NGINX. After a successful test, reload NGINX so existing connections can finish while new connections use the changed configuration. The exact service-manager command varies by operating system.
- Exercise both paths. Request HTTP, HTTPS, the ACME challenge URL, and a Rails page that emits an absolute URL. Confirm the redirect, certificate name, secure URL scheme, and application response.
Verification commands and expected results
Use a temporary challenge file to test the webroot without waiting for a real issuance attempt:
mkdir -p /var/www/letsencrypt/.well-known/acme-challenge
echo ok > /var/www/letsencrypt/.well-known/acme-challenge/ping
curl -i http://example.com/.well-known/acme-challenge/pingThe response should be successful and contain ok, not a 301 redirect. Remove the test file afterward.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Check the normal redirect and HTTPS response:
curl -I http://example.com/
curl -I https://example.com/The first request should return a 301 whose Location uses https://. The second should complete a valid TLS handshake and return the Rails response status. Test each hostname listed in server_name; a certificate that covers only one name will still fail for the other.
Inspect a generated link, form action, redirect, or canonical URL from the Rails application. It should use https://example.com, retain the public host, and avoid a second redirect caused by Rails believing the request was HTTP. Browser developer tools can confirm that cookies and redirects are marked for the secure origin, while NGINX access logs help distinguish proxy errors from Rails errors.
Automate and test certificate renewal
Run a dry run before trusting unattended renewal
Certbot provides a renewal simulation that exercises the renewal path without replacing the live certificate:
Free tools Windows power users keep installed
One-click scans. No signup required.
certbot renew --dry-runRun this while the HTTP-01 location is reachable, or use the equivalent staging/test mode for your chosen validation method. A successful dry run demonstrates more than file readability: it checks that the authority can complete validation from outside your server. It does not remove the need to monitor expiry and renewal failures.
Ensure NGINX loads a renewed certificate
Renewal writes new certificate material, but NGINX normally continues using the certificate loaded by its existing worker processes until it is reloaded. Configure the certificate client’s post-renewal or deploy hook to run an NGINX configuration test and reload only when the test succeeds. A representative shell hook is:
nginx -t && systemctl reload nginxThe command used to reload the service depends on your init system. If you manage certificates manually, perform the same sequence after copying the new files: verify the matching key, run nginx -t, reload, and make a fresh HTTPS request.
Monitor the renewal job
- Verify that a scheduled Certbot timer, cron job, or platform-managed task actually runs; do not assume installation created one.
- Keep logs for validation failures, permission errors, and reload failures.
- Alert before expiry so a failed renewal is corrected while the current certificate is still valid.
- Periodically perform a dry run and an external HTTPS check from outside the server network.
Troubleshooting by symptom
| Symptom | Likely cause | Checks and corrective action |
|---|---|---|
| Browser reports an expired, self-signed, or wrong-name certificate. | NGINX is serving an old certificate, the file path is wrong, or the request reached another server block. | Confirm DNS and the server_name, inspect the configured ssl_certificate path, run nginx -t, reload NGINX, and test every hostname separately. |
nginx -t says the certificate or key cannot be opened. |
Path, ownership, mode, or directory traversal permissions prevent the NGINX master from reading the files. | Check that both files exist, that the key matches the certificate, and that the master process has read access without making the key world-readable. |
| HTTP-01 renewal returns a challenge-not-found or redirect error. | The challenge location is being redirected, proxied, blocked, or served from a different root. | Fetch a test token over plain HTTP, keep the location ^~ /.well-known/acme-challenge/ block ahead of the general redirect, and verify port 80 reaches this NGINX instance. |
| Every request redirects repeatedly between HTTP and HTTPS. | Rails does not know that TLS was terminated upstream. | Ensure the HTTPS proxy block sends X-Forwarded-Proto https, Rails has config.force_ssl = true only once in the intended environment, and no intermediate proxy overwrites the scheme. |
Rails generates http:// links after HTTPS is working. |
The forwarded scheme or host is missing or incorrect. | Set Host $http_host and X-Forwarded-Proto https, restart Rails after configuration changes, and inspect the generated URL again. |
| HTTPS returns 502 Bad Gateway. | NGINX cannot connect to the Rails upstream. | Check that Puma, Unicorn, or the selected server is running on the address and port in proxy_pass, and that local firewall or socket permissions allow NGINX to connect. |
| The new certificate is present on disk but clients still see the old one. | NGINX has not reloaded, or the reload was rejected. | Run nginx -t, inspect the reload log, reload only after a successful test, and make a new TLS request rather than relying on a cached browser connection. |
| One hostname works while another fails. | The second name is absent from DNS, server_name, or the certificate’s covered names. |
Add the name consistently to DNS, the relevant server block, and the issuance request, then renew and reload the certificate. |
One host versus multiple SNI hostnames
A single NGINX instance can serve multiple HTTPS hostnames by using separate server blocks and certificates selected through SNI. For each name, define the appropriate server_name, certificate paths, ACME coverage, and Rails routing behavior. A certificate may cover several names when it is issued for them together; verify that every public name is actually included rather than assuming that one certificate covers all future aliases.
Keep the port-80 challenge handling aligned with the HTTPS names. If one hostname is served by a different machine, its DNS and ACME request must reach that machine; adding the name only to an NGINX configuration elsewhere will not complete validation.
Security and operational checklist
- Use TLS 1.2 and TLS 1.3 in the HTTPS server block unless a documented compatibility requirement dictates otherwise.
- Restrict private-key permissions and audit backups, deployment artifacts, and logs for accidental key exposure.
- Keep port 80 available for HTTP-01 validation, but redirect normal application requests to HTTPS.
- Run
nginx -tbefore every reload, including reloads triggered by renewal automation. - Test the complete path after changes: DNS, port 443, certificate name, Rails response, generated URLs, and challenge-file retrieval.
- Use a dry-run renewal test before relying on unattended operation and monitor both renewal and reload failures.
- If internal policy requires encryption between NGINX and Rails, use an HTTPS upstream and manage that second certificate trust relationship separately.
Final configuration model
For a conventional Rails deployment, NGINX owns the public TLS endpoint and certificate files, while Rails owns application behavior and HTTPS policy. Port 80 serves only ACME challenges and redirects normal traffic. Port 443 loads the certificate and private key, limits protocols to TLS 1.2 and TLS 1.3, and forwards the original host, client chain, and HTTPS scheme to the Rails server. Rails enables config.force_ssl = true, and every configuration or renewal change follows the same safe cycle: test, reload, and verify from the outside.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
