An Nginx HTTPS redirect problem is usually caused by putting the right rule in the wrong server block. Port 80 should receive plain HTTP and return one permanent redirect to the HTTPS URL. Port 443 should terminate TLS and then serve the site or proxy the request to your application. If the 443 block also contains an unconditional return 301, or if the upstream application sends an HTTP Location header, the browser can loop between URLs or downgrade back to HTTP.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Start by identifying which server block answers, validate the active configuration, verify the certificate and key, then inspect every redirect in the response chain. The smallest correct fix is normally to keep the redirect only on port 80, restore the serving or proxying location on port 443, and rewrite upstream locations when the public site is HTTPS but the backend still advertises HTTP.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What the correct port 80 and 443 layout looks like
Nginx handles HTTP and HTTPS in separate server blocks. The port-80 block has no TLS certificate because its job is only to redirect. The port-443 block enables TLS, presents the certificate, and serves static files or forwards the request to an application.
server {
listen 80;
server_name example.com www.example.com;
return 301 https://example.com$request_uri;
}
server {
listen 443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/nginx/tls/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/privkey.pem;
location / {
proxy_pass http://app;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
}
}The important separation is functional, not cosmetic:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- Port 80: accepts HTTP and returns a single
301to the HTTPS equivalent. - Port 443: listens with
ssl, loads the certificate and private key, and contains the reallocationthat serves or proxies the request. - Application: receives the original host and the scheme Nginx saw through request headers.
Nginx requires the ssl parameter on the listening socket and paths to both the server certificate and private key for an HTTPS server. The SSL module depends on OpenSSL.
Recognize the symptom before changing configuration
A browser’s generic “too many redirects” message does not tell you which layer is wrong. Inspect the HTTP response headers so you can see whether Nginx, an upstream application, or another front-end is issuing the redirect.
- Check the plain-HTTP entry point:
curl -I http://example.comIt should return one redirect whose
Locationbegins withhttps://and preserves the requested path and query string. - Check HTTPS with normal certificate verification:
curl -I https://example.com - Only when certificate validation itself is the test, bypass verification temporarily:
curl -k -I https://example.com-kdoes not fix TLS. It merely lets you inspect the HTTP response when the certificate is expired, self-signed, issued for another name, or otherwise untrusted. - Follow the chain when necessary and record every
Locationvalue:curl -I -L http://example.com
A healthy arrangement normally looks like http://example.com/path → https://example.com/path → a 200, application response, or another intentional application redirect. Repeated alternation between HTTP and HTTPS, repeated redirects to the same URL, or a redirect from HTTPS back to HTTP identifies the next layer to inspect.
Check which Nginx server block is answering
Nginx chooses a listening socket and then matches the requested hostname against server_name. A valid block on disk is irrelevant if Nginx loaded a different file, selected another default server, or does not recognize the hostname.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Confirm DNS and the destination host
Make sure the domain resolves to the machine or front-end where you are editing Nginx. If DNS points elsewhere, your local configuration changes cannot affect the response. Test the public hostname rather than relying only on a local IP request, because the hostname is what drives server_name selection.
Recommended Free Tools
Inspect the loaded configuration
- Validate syntax and referenced files:
nginx -tA failure here must be fixed before any reload.
- Print the complete configuration Nginx has loaded:
nginx -T - In the output, locate every
listen 443directive, everydefault_serverdesignation, and every matchingserver_name. - Confirm that the hostname in the request appears in the intended 443 block and that there is only one intended default server for that port.
Pay attention to included files. A distribution may load several snippets, and an old HTTPS block can still answer even after a new virtual-host file is edited. The active configuration shown by nginx -T, not the file you expected to be active, is the source of truth.
Verify the 443 TLS listener and certificate
The 443 block must contain listen 443 ssl, a certificate path, and a private-key path. If the request never completes TLS, you are dealing with a listener or certificate problem rather than an HTTP redirect rule.
Check the certificate files and chain order
The certificate file should contain the server certificate first, followed by any intermediate certificates. Putting an intermediate before the server certificate can produce chain failures, and an incorrect certificate/key pair can prevent Nginx from starting with a key values mismatch error.
After correcting files, test before reloading:
nginx -tDo not remove the private key or replace a working certificate blindly while troubleshooting redirects. A browser that reaches an HTTPS response has already completed enough TLS negotiation to let you continue with HTTP-layer diagnostics; focus on the response headers unless the client reports a certificate error.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Check that the certificate matches the requested name
The certificate presented on 443 must cover the hostname in the URL. If the request is sent to a different name than the one listed in the certificate or server_name, correct the hostname selection first. Testing with curl -k can reveal the redirect chain, but it intentionally hides trust and name-validation failures, so use a normal curl -I https://... test afterward.
Remove redirect logic from the HTTPS serving block
The most direct cause of a loop is an unconditional redirect in the block that receives HTTPS. For example, this configuration never reaches the application:
server {
listen 443 ssl;
server_name example.com;
return 301 https://example.com$request_uri;
location / {
proxy_pass http://app;
}
}Every request that arrives over HTTPS immediately receives another HTTPS redirect, so the client repeats the same request. Remove that return from the 443 block and restore the intended location /. Keep the HTTP-to-HTTPS return 301 only in the port-80 block.
Also inspect conditional redirects and rewrites. A rule that tests the wrong variable, or a rewrite copied from the HTTP block into the HTTPS block, can recreate the same behavior even when there is no obvious unconditional return.
Find redirects generated by the upstream application
Nginx may be proxying correctly while the backend sends a redirect that exposes its internal scheme or hostname. A common pattern is:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- The browser requests
https://example.com. - Nginx terminates TLS and proxies to an application over HTTP.
- The application believes the request is HTTP because it did not receive the expected forwarding header.
- The application responds with
Location: http://example.com/.... - The browser follows that URL to port 80, which redirects back to HTTPS, producing a loop.
Preserve the public host and scheme in the proxy request:
location / {
proxy_pass http://app;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
}If TLS is terminated by a load balancer or another front-end before Nginx, $scheme at Nginx may be http even though the visitor used HTTPS. In that architecture, configure the trusted front-end to pass the original scheme and configure Nginx or the application to use that value consistently. Do not accept arbitrary client-supplied forwarding headers as trusted identity; only the controlled proxy in front of Nginx should set them.
Rewrite an upstream Location header when necessary
The proxy_redirect directive changes Location and Refresh headers in responses from a proxied server. Use it when the backend returns an internal URL that is not the URL visitors should follow.
location / {
proxy_pass http://app;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect http://app/ https://example.com/;
}Adjust the source and replacement to the actual URL emitted by your application. First capture the exact header with curl -I; do not guess at a replacement string. If the backend emits a different host, port, or path, the rewrite must match that value. Fixing the application’s external URL and trusted-proxy settings is usually preferable when you control the application; proxy_redirect is the Nginx-side correction when the upstream response cannot be changed.
Audit rewrite rules for internal processing loops
Both return and rewrite ... permanent can send a 301 response. Internal rewrites can also cause Nginx to process a request repeatedly. The rewrite module limits repeated processing to ten cycles; after that, Nginx returns 500.
Common loop patterns
- A rule rewrites a URI to itself, directly or after adding and then removing a trailing slash.
- A
lastrewrite sends the request to a location where the same rule runs again. - An HTTPS condition is inverted, so an already secure request is redirected as if it were HTTP.
- Two included snippets each add a canonical-host or canonical-scheme redirect, causing them to fight.
Use nginx -T to search the complete loaded configuration for every return 301, return 302, rewrite, and if related to the affected host. Temporarily simplify the 443 block to one serving location, test, and add rules back one at a time. This isolates the rule that changes the response.
Understand status 497 on port 443
Status 497 is Nginx’s indication that a regular HTTP request was sent to an HTTPS port. It is not the same as an ordinary application redirect and does not mean the certificate is necessarily wrong.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Typical causes include:
- A client uses
http://with an explicit port of443. - A front-end proxy forwards plain HTTP to Nginx’s TLS listener instead of using the correct upstream protocol.
- A health check is configured for HTTP on port 443.
- An application constructs an internal URL with the wrong scheme and port.
Fix the sender or front-end listener so HTTP goes to port 80 and TLS traffic goes to port 443. Treating 497 as an application-level 301 can hide the real protocol mismatch.
Choose the fix by failure layer
| Observed result | Likely layer | Smallest corrective action |
|---|---|---|
| HTTPS request reaches a 301 that points to the same HTTPS URL | Redirect logic in the 443 block | Remove the unconditional return or self-targeting rewrite and restore the serving location. |
| HTTPS redirects to HTTP, then HTTP redirects back to HTTPS | Upstream scheme or proxy headers | Pass the original scheme and correct the upstream Location with application settings or proxy_redirect. |
| The expected hostname is answered by another site | Listener and server_name selection |
Correct DNS, hostname spelling, included files, and the 443 default-server arrangement. |
| Nginx will not reload; error mentions key values mismatch | Certificate/key pairing | Install the matching private key and certificate, with the server certificate first in the chain, then run nginx -t. |
| Repeated internal rewrites end in 500 | Rewrite processing loop | Remove the self-referencing rule or incorrect last transition; Nginx stops after ten cycles. |
| Status 497 on 443 | Protocol sent to the listener | Send HTTP to port 80 or configure the front-end health check and proxy protocol correctly. |
Apply and verify a change safely
- Save a copy of the currently working configuration before editing.
- Make one narrowly scoped change at the layer identified by the response headers.
- Run
nginx -t. Do not reload if it reports an error. - Inspect
nginx -Twhen a rule appears to be ignored; an included file or duplicate server may still be active. - Reload Nginx only after syntax validation succeeds.
- Repeat the exact
curl -Itests for HTTP and HTTPS, recording status codes and completeLocationvalues. - Test the original path, a path with a query string, and the canonical hostname. A fix that works only for
/may still lose the URI or loop on another location.
Change one layer at a time. Replacing certificates, redirect rules, proxy headers, and application settings simultaneously makes it impossible to tell which change solved—or introduced—the problem.
When the configuration is correct but the loop remains
If the local 443 block has the right listener, certificate, host name, and serving location, inspect infrastructure in front of it. A CDN, load balancer, ingress controller, or health checker can terminate TLS, forward HTTP, or add its own canonical redirect. Compare the scheme at each hop:
- Visitor to front-end: HTTPS or HTTP?
- Front-end to Nginx: HTTPS or HTTP?
- Nginx to application: what does
X-Forwarded-Protosay? - Application response: what exact URL appears in
Location?
Every component must agree on the public canonical scheme and host. If one component believes the public request is HTTP while another enforces HTTPS, the resulting two-rule cycle will persist regardless of how the certificate is configured.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Final verification checklist
- Port 80 has the sole HTTP-to-HTTPS permanent redirect for the host.
- Port 443 uses
listen 443 ssland the intendedserver_name. - The certificate file starts with the server certificate and then contains intermediates.
- The private key matches the certificate and
nginx -tsucceeds. - The 443 block serves or proxies the request instead of issuing an unconditional redirect.
- Proxy headers describe the public host and original scheme.
- Any upstream HTTP
Locationis corrected in the application or withproxy_redirect. - Rewrite rules do not send the request back through the same location indefinitely.
- No front-end proxy or health check sends plain HTTP to the TLS listener.
curl -Ishows the intended one-way redirect and then the expected application response.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
