What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
An NGINX HTTPS loop occurs when two request-handling layers disagree about the scheme. The usual examples are Cloudflare Flexible mode talking HTTP to an origin that redirects to HTTPS, or a load balancer terminating TLS and forwarding plain HTTP to NGINX, which then mistakes the request for an insecure visit. Trace every hop, identify where TLS terminates, make one trusted layer own the HTTP-to-HTTPS redirect, and point any tunnel or proxy at an HTTPS origin when the origin requires it.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What an HTTPS redirect loop actually is
A browser reports ERR_TOO_MANY_REDIRECTS when it follows a chain of HTTP redirects without reaching a final response. The visible address bar shows only the public URL; it does not tell you which component returned each 301, 302, 307, or 308 response. NGINX, an ingress controller, a load balancer, a CDN, a tunnel, or the application can all emit a redirect.
As an Amazon Associate I earn from qualifying purchases.
The loop is created by a disagreement about the request scheme:
- An edge proxy receives HTTPS from the visitor but sends HTTP to the origin. NGINX sees HTTP and redirects to HTTPS, so the edge sends the request over HTTP again.
- Cloudflare Flexible mode uses HTTP between Cloudflare and the origin while the origin forces HTTPS. Cloudflare repeats the same transition.
- A proxy or tunnel sends HTTP to an origin that answers with an HTTPS
Locationheader. The proxy repeats the HTTP request instead of using the origin’s HTTPS listener. - One layer redirects HTTPS to HTTP while another redirects HTTP back to HTTPS.
The durable fix is not to add another unconditional redirect. It is to establish the real scheme at each hop, trust only a proxy-controlled forwarded scheme, and leave the redirect policy to one layer.
#1 Best Overall
Capture the redirect chain before changing configuration
Start from a client that can reach the public hostname. These commands show response headers without downloading the page:
curl -sS -D - -o /dev/null https://example.com/
curl -sS -D - -o /dev/null -L --max-redirs 5 https://example.com/The first command shows the initial status and Location. The second follows at most five redirects, allowing you to see whether the target repeats or alternates between schemes. Record every status code and destination in order.
- A repeated identical
Locationmeans the same transition is being requested again. - An alternating
http://andhttps://destination usually means two layers have opposite policies. - Any of 301, 302, 307, or 308 can participate in the loop; do not assume the status code identifies the responsible product.
If the chain ends at a different hostname, path, or port, include those values in your notes. A redirect can be correct for one URL and still create a loop after another component rewrites the host or path.
Test the origin without the public proxy
Run a direct request from the proxy, tunnel, or host that can reach NGINX. Preserve the production host name so that NGINX selects the same virtual server:
curl -sS -D - -o /dev/null
-H "Host: example.com"
http://127.0.0.1:80/If the HTTP listener returns an HTTPS Location, any tunnel or proxy configured with an HTTP service URL will repeatedly send requests back to that listener. Either use the origin’s HTTPS endpoint or change the origin redirect policy. Test the HTTPS listener as well:
curl -sS -D - -o /dev/null
--resolve example.com:443:127.0.0.1
https://example.com/The direct result separates an origin problem from an edge problem. If the origin responds normally over HTTPS but the public hostname loops, inspect the CDN, load balancer, ingress, or tunnel. If the origin itself redirects unexpectedly, inspect its server and location blocks and the application settings before changing the edge.
Rank #2
Find where TLS terminates
Write down the path a request takes. The correct NGINX configuration depends on whether NGINX receives the encrypted connection or only receives a forwarded request.
| Topology | What NGINX receives | Where the HTTPS decision belongs |
|---|---|---|
| TLS terminates at NGINX | HTTP on port 80 and HTTPS on port 443 | NGINX can redirect port 80 to HTTPS and serve the application on 443 |
| TLS terminates at a load balancer, CDN, or ingress | Usually plain HTTP from the trusted upstream | The upstream must convey the visitor’s scheme, normally with X-Forwarded-Proto; NGINX must not treat every upstream HTTP connection as an insecure visitor |
| HTTP tunnel to an HTTPS origin | The tunnel deliberately connects to the origin over HTTP | Use an HTTPS service URL when the origin redirects HTTP to HTTPS, or remove the origin redirect |
Ask the infrastructure owner which component terminates TLS, which component can set X-Forwarded-Proto, and whether direct access to NGINX is restricted. A forwarded header is meaningful only when a trusted proxy overwrites it; a client must not be allowed to choose its value.
Configure the simple case: TLS terminates at NGINX
When NGINX owns the certificate and accepts both listeners, keep the redirect on the HTTP virtual server and serve the site from the HTTPS virtual server. A minimal pattern is:
server {
listen 80;
server_name example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name example.com;
# certificate and application proxy settings belong here
}The important property is separation: port 80 redirects, while the HTTPS server handles the request. Do not place the same unconditional redirect in the HTTPS server. Also check for a second redirect in the application, an included configuration file, or an ingress annotation. Two correct redirects in different layers can still form a loop when one layer believes the request is HTTP.
Free tools Windows power users keep installed
One-click scans. No signup required.
After reloading NGINX, repeat both public curl commands and the direct origin tests. A single HTTP-to-HTTPS transition followed by a non-redirect response confirms that this topology is behaving as intended.
Handle TLS termination before NGINX
With a load balancer, CDN, or ingress in front, the connection from that component to NGINX can be HTTP even when the visitor used HTTPS. The upstream must set or overwrite X-Forwarded-Proto: https for an HTTPS visitor and X-Forwarded-Proto: http for an HTTP visitor. NGINX or the ingress controller can then make a decision from that value.
NGINX Ingress documents a redirect-to-https behavior that evaluates http_x_forwarded_proto. Prefer the controller’s documented feature when it is available, because it encodes the expected proxy topology.
A topology-specific NGINX pattern for a trusted proxy is:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →# Use only when the trusted proxy sets and overwrites X-Forwarded-Proto
if ($http_x_forwarded_proto = "http") {
return 301 https://$host$request_uri;
}This example is intentionally conditional. Do not add an unconditional HTTPS redirect to a server block that receives HTTPS traffic from the proxy as plain HTTP; that would redirect even requests that were already secure at the edge. Restrict the NGINX listener so untrusted clients cannot connect directly and forge the forwarded header. If the proxy can pass a client-supplied value unchanged, fix that trust boundary before relying on the header.
When the upstream does not provide a trustworthy scheme, choose one owner for the redirect instead. For example, the edge can redirect HTTP visitors while NGINX serves the forwarded request without issuing another scheme redirect. The exact owner matters less than having one consistent policy.
Fix Cloudflare SSL/TLS mode loops
Why Flexible mode loops
Cloudflare Flexible mode accepts HTTPS from the visitor but uses unencrypted HTTP to the origin. If the origin redirects every HTTP request to HTTPS, Cloudflare receives that redirect and starts the same HTTP origin request again. The browser therefore sees a loop even though the public URL is already HTTPS.
Choose Full or Full (strict) when the origin supports HTTPS
Cloudflare’s documented remedy is to remove the origin’s HTTPS redirect or change the zone’s SSL/TLS Encryption Mode to Full or higher. Full and Full (strict) require the origin to serve HTTPS; Full (strict) also requires a valid certificate at the origin. Install a certificate whose hostname matches the requested site before switching modes.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Do not leave an origin-only redirect in place while using Flexible. If the edge is the sole redirect owner, the origin can serve the request over the protocol Cloudflare uses. If the origin is also required to enforce HTTPS, use Full or Full (strict) so Cloudflare connects to it over HTTPS.
Check dashboard and origin rules together
Review Cloudflare dashboard redirect rules as well as NGINX and application settings. An edge rule whose target begins with http can deliberately send an HTTPS request back to HTTP, where the origin immediately redirects again. Remove that conflict or change the target to the intended HTTPS URL. Also check for Always Use HTTPS and any newer redirect-rule configuration; only one layer should perform the scheme transition.
Correct Cloudflare Tunnel service URLs
A Tunnel route with an HTTP Service URL always connects to the origin over HTTP. If that origin responds with an HTTPS Location, the tunnel repeats the HTTP request and can loop indefinitely.
- Set the Tunnel Service URL to an HTTPS endpoint such as
https://localhost:443, or to the appropriate HTTPS address for your origin. - Set the origin server name to the hostname covered by the origin certificate so the TLS handshake uses the correct SNI value.
- Keep certificate verification enabled when the origin certificate is publicly trusted.
- Retest the route and inspect the response headers. The origin should now receive HTTPS instead of being asked to redirect every HTTP request.
If you cannot serve HTTPS on the origin, remove or revise the origin redirect policy and let the edge enforce the public HTTPS URL. An HTTP Service URL and an origin that insists on HTTPS are incompatible settings.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Validate the certificate and SNI separately
A redirect may be fixed while the origin still presents the wrong certificate. That can look like a tunnel or routing failure. Test the listener with the same hostname the proxy will use:
openssl s_client -connect 127.0.0.1:443
-servername example.com
-verify_hostname example.com
-verify_return_error </dev/nullConfirm that the certificate covers example.com and that the verify return code is 0 (ok). If the name does not match, correct the certificate or the tunnel’s origin server name before diagnosing another redirect. Testing by IP without -servername can select a default certificate and produce a misleading mismatch.
Audit every component that can issue a redirect
Search the complete request path, not only the file you edited. In NGINX, inspect both server and location contexts for:
return 301,return 302, and otherreturndirectives;rewriterules that change the scheme, host, port, or path;error_pagedirectives that point to an HTTP or HTTPS URL;- included configuration files and the default server that might catch an unexpected host;
- proxy settings that set, preserve, or overwrite
X-Forwarded-Proto.
Then inspect the layers around NGINX:
- Ingress annotations such as
ssl-redirectandredirect-to-https; - load-balancer or CDN redirect rules;
- Cloudflare SSL/TLS mode, Always Use HTTPS, and redirect rules;
- Cloudflare Tunnel Service URL and origin server name;
- application framework canonical-URL, secure-cookie, or force-HTTPS settings;
- HSTS headers already cached by browsers.
NGINX’s return and error_page directives can both generate browser redirects, so a server-level rule can conflict with a more specific location rule. Keep a written map of which layer owns the redirect and remove duplicate ownership.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsUse the symptom to choose the next test
The public URL repeats HTTPS to HTTPS
Run the two curl commands and inspect the response server headers if present. If every response points to the same HTTPS URL, look for an edge rule, application canonical-URL rule, or a proxy that changes the host or port while leaving the browser-visible URL unchanged. Test the origin directly with the production Host header; a clean origin response shifts the investigation to the edge.
The chain alternates HTTP and HTTPS
This is the classic two-owner conflict. Compare the component that issued the HTTPS redirect with the component that issued the HTTP redirect. Cloudflare Flexible plus an origin HTTPS redirect is one known pattern; an HTTPS-to-HTTP redirect from a load balancer combined with NGINX’s port-80 redirect is another. Remove one policy or make the upstream scheme visible and trusted.
The loop appears only through a tunnel
Request the origin directly from the tunnel host. If the HTTP listener returns an HTTPS Location, change the Tunnel Service URL to HTTPS and validate SNI and the certificate. If the origin’s HTTPS listener is unavailable, decide whether the origin or edge should enforce HTTPS and configure the other layer not to contradict it.
The redirect stops but the browser reports a certificate error
Run the openssl s_client command with the production hostname. Correct certificate coverage, SNI, or trust-chain issues independently of the redirect policy. A successful HTTP-to-HTTPS transition does not prove that the TLS endpoint is serving the right certificate.
curl works but a browser still loops
Check for cached redirects and HSTS behavior in the browser, then test with a clean profile or a different client. Re-run the command against the exact hostname and path that fails. If the command shows a finite chain but the browser does not, inspect browser-held HSTS and application-generated navigation rather than adding another server redirect.
Roll out the correction safely
- Save the current NGINX, ingress, CDN, and tunnel configuration so you can compare the change.
- Identify the TLS termination point and the single layer that will own the HTTP-to-HTTPS transition.
- Make the proxy overwrite
X-Forwarded-Protoand restrict direct access to NGINX when that header is used. - Apply the smallest configuration change: change the Cloudflare mode, switch the Tunnel Service URL, remove a duplicate redirect, or correct the conditional scheme check.
- Validate the origin directly with the production host header and validate the certificate with SNI.
- Run the public
curltests with--max-redirs 5and record every status andLocation. - Test both an HTTP entry URL and an HTTPS entry URL, plus representative paths that the application or CDN may rewrite.
- Only after the chain is stable should you retain HSTS or other browser-enforced HTTPS policies.
Configuration checklist
- There is one documented owner for the HTTP-to-HTTPS redirect.
- Every proxy hop’s scheme is known; TLS termination is not assumed from the browser URL.
X-Forwarded-Protois overwritten by a trusted proxy and cannot be supplied directly by an untrusted client.- Cloudflare is not in Flexible mode while the origin forces HTTPS.
- A Cloudflare Tunnel uses an HTTPS Service URL when the origin serves HTTPS or returns an HTTPS redirect.
- The origin certificate matches the hostname and passes SNI verification with return code
0 (ok). - NGINX
return,rewrite, anderror_pagedirectives have been reviewed in both server and location contexts. - Ingress annotations, CDN rules, application canonical URLs, and HSTS settings do not introduce a second or reverse redirect.
- Public and direct-origin
curltests show a finite chain and a final non-redirect response.
The durable fix
An NGINX HTTPS loop is a topology problem, not a missing redirect directive. Trace the headers, test the origin, identify the TLS terminator, and then align the proxy’s scheme signal with the component that owns the redirect. Cloudflare Flexible must not front an origin that forces HTTPS; an HTTP tunnel must not target an origin that answers with an HTTPS location; and NGINX must not redirect every upstream HTTP connection when a trusted proxy has already established that the visitor used HTTPS.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
