Fix the problem by separating the two jobs: the port 80 server block should redirect HTTP to HTTPS, while the port 443 block should terminate TLS and serve or proxy the application. The HTTPS block must match the requested hostname, use listen 443 ssl, and reference a valid certificate and private key. If that block returns another redirect, or an upstream application sends an HTTP Location header, the browser can loop or appear to downgrade to HTTP.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Start with the configuration pattern below, then trace the actual response chain with curl. The first incorrect status code or Location header identifies the layer to fix.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
The correct two-block configuration
Keep redirect logic and HTTPS serving logic in separate server blocks. Port 80 receives an unencrypted request and sends it to the canonical HTTPS URL. Port 443 performs the TLS handshake and then serves files or proxies the request to your application.
server {
listen 80;
server_name example.com www.example.com;
return 301 https://example.com$request_uri;
}
server {
listen 443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/nginx/tls/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/privkey.pem;
location / {
proxy_pass http://app;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
}
}The TLS server needs the ssl parameter on its listening socket and paths to both certificate and private-key files. The SSL module depends on OpenSSL. If you are serving static content instead of proxying, replace the proxy_pass location with a root directive and the appropriate index settings.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
| Element | Purpose | What to verify |
|---|---|---|
listen 80 |
Accepts plain HTTP. | It contains the HTTP-to-HTTPS redirect and no application proxy. |
return 301 https://…$request_uri |
Preserves the path and query string while changing the scheme. | The hostname is your canonical name, not an unintended alias. |
listen 443 ssl |
Accepts HTTPS and negotiates TLS. | The socket is present on the intended address and port. |
server_name |
Selects the virtual host after the connection arrives. | Every hostname users request appears in the correct 443 block. |
ssl_certificate |
Supplies the server certificate and chain. | The file is readable and starts with the server certificate. |
ssl_certificate_key |
Supplies the private key matching that certificate. | The key matches; permissions allow Nginx to read it. |
proxy_set_header X-Forwarded-Proto $scheme |
Tells the upstream whether the public request was HTTP or HTTPS. | The application trusts this header only from your proxy. |
First identify which component is redirecting
Do not change several layers at once. A browser may hide intermediate responses, cache a permanent redirect, or display only the final URL. Inspect each hop directly from a shell that can reach the server.
- Confirm DNS resolves the hostname to the intended Nginx host. Check both the apex name and any
wwwalias used by your configuration. - Request the HTTP endpoint and print headers:
curl -I http://example.com. A healthy result is one301with aLocationbeginning withhttps://and the same path. - Request HTTPS:
curl -I https://example.com. If the certificate is valid, this shows whether the 443 block serves content or emits another redirect. - Use
curl -k -I https://example.comonly to isolate HTTP behavior when certificate validation itself is the suspected problem. The-koption deliberately ignores certificate verification; it is not a production fix. - Record every status and exact
Locationvalue. Repeated alternation betweenhttp://andhttps://, a change of hostname, or a redirect to an internal port reveals where the loop starts.
If HTTP redirects correctly but HTTPS returns a redirect, the port 443 server or its upstream is responsible. If the HTTPS request fails before an HTTP status appears, investigate TLS, certificate selection, or a front-end listener instead of rewrite rules.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Verify the active Nginx configuration
Editing a file does not guarantee that Nginx loaded it. A distribution may include files from a directory you did not edit, and an earlier default server can win when names do not match.
- Run
nginx -t. Continue only after it reports a successful syntax test. A failed test means the running worker processes still use the previous valid configuration. - Run
nginx -Tand inspect the complete expanded configuration. Search for everylisten 443,default_server,server_name,return 301,return 302, andrewrite. - Make sure there is one deliberate default server for each 443 address/port combination. Remove or disable an unintended default that catches the request before the named virtual host.
- Check that the requested hostname exactly matches a
server_name. A missing alias, spelling difference, or request sent to an IP address can select the default block and produce an unexpected certificate or redirect. - After a successful test, reload Nginx using your operating system’s service manager. Re-run the
curlchecks rather than relying on a browser tab that may have cached a 301.
Remove redirects from the HTTPS serving block
The most common configuration mistake is copying the HTTP redirect into the 443 block. An unconditional return 301 executes before the location / proxy or static file handler, so the application is never reached.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/nginx/tls/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/privkey.pem;
# Do not put an unconditional return 301 here.
location / {
proxy_pass http://app;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
}
}An Nginx mailing-list troubleshooting response summarized this fix as: “The return directive needs to be removed from the configuration file.” The redirect belongs in the port 80 block; the 443 block needs a content handler. Conditional redirects can be valid for a specific path, but test their condition carefully and ensure they cannot match every HTTPS request.
Check certificate files, key pairing, and chain order
A redirect symptom can mask a TLS configuration problem, especially when a load balancer or browser retries another endpoint after a handshake failure. Nginx’s HTTPS guidance requires the certificate and private-key locations in the HTTPS server block.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsUse the complete chain in the right order
The certificate file should contain the server certificate first, followed by any intermediate certificates. Putting an intermediate first, omitting an intermediate, or concatenating unrelated certificates can prevent clients from building a trust chain. Nginx can report a key values mismatch error when the configured key does not correspond to the server certificate.
- Confirm the certificate’s subject and subject-alternative names include the hostname users request.
- Confirm the private key belongs to that certificate; do not substitute a key from another renewal.
- Check file ownership and permissions so the Nginx master or worker can read the files without making the private key world-readable.
- After replacing files, run
nginx -tbefore reloading. A failed test leaves the previous configuration active.
These checks address TLS negotiation. They do not fix an HTTP 301 or 302 generated after TLS succeeds; use the response-chain method for that case.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Trace redirects generated by the upstream application
With reverse proxying, Nginx can be correctly configured while the application still believes the request was HTTP. Many frameworks then redirect to an HTTPS URL, or generate absolute links pointing at an internal hostname and port. The result may be a loop, a port leak, or a downgrade back to HTTP.
Send the original scheme to the application
Keep the public host and scheme in proxy headers:
location / {
proxy_pass http://app;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
}Configure the application to trust these headers only when the connection comes from your Nginx or load-balancer network. If it ignores X-Forwarded-Proto, it may issue an HTTPS redirect on every request because it sees the internal proxy connection as HTTP. If it blindly trusts client-supplied headers, an attacker could spoof the scheme, so restrict trusted proxies at the application layer.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rewrite upstream Location and Refresh headers when necessary
Nginx’s proxy_redirect directive changes the Location and Refresh headers in a proxied response. Use it when the upstream sends an internal HTTP URL that must be represented as the public HTTPS URL.
location / {
proxy_pass http://app;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect http://app/ https://example.com/;
}The replacement must reflect the URL the upstream actually emits. Inspect the header first; do not add a broad rewrite that could alter unrelated redirects. If the application can be configured to generate public HTTPS URLs natively, that is usually clearer than compensating for every response at the proxy.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Find rewrite and return loops
Both return and rewrite ... permanent can issue 301 responses. A rewrite may also send processing back through location selection. The rewrite module limits repeated processing to 10 cycles; after that Nginx returns status 500.
Typical loop patterns
- A 443 block redirects to HTTP while the 80 block redirects back to HTTPS.
- A canonical-host rule alternates between two names, such as an apex domain and
www. - A trailing-slash rule redirects a path to itself because the condition never changes.
- A
rewrite ... lastsends the request to a location that applies the same rewrite again. - An upstream redirects to an internal HTTP URL, while Nginx or the application upgrades it to HTTPS on the next hop.
Reduce the rules to one canonical decision
Choose one canonical scheme and hostname. Put the unconditional scheme redirect only on port 80, then make host or path rules explicit and mutually exclusive. Prefer a direct return 301 for simple canonicalization. Use rewrite only when you need pattern matching, and verify that the rewritten URI eventually reaches a content handler.
When debugging, temporarily comment out nonessential rewrite rules, reload after nginx -t, and test one URL at a time. Restore rules individually so the first new redirect is identifiable.
Understand status 497 on port 443
Status 497 means a regular HTTP request was sent to an HTTPS port. The client spoke plain HTTP to a socket expecting a TLS handshake. This is not the same as an application redirect loop.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
- Fix the client URL so it uses
https://when connecting to port 443. - Check a front-end proxy, health check, or load balancer that may be configured with HTTP while targeting the backend’s 443 listener.
- If you intentionally need both protocols, expose HTTP on port 80 and redirect there; do not send cleartext traffic directly to the TLS socket.
Use the 497 response as evidence about the protocol arriving at the listener. Changing proxy_redirect or application rewrite rules cannot correct a client that never completed TLS.
Account for a CDN or load balancer in front
A front-end proxy can terminate TLS and connect to Nginx over HTTP. In that design, Nginx sees an HTTP backend connection even though the visitor used HTTPS. If the front end does not pass a trusted scheme header, Nginx or the application may redirect repeatedly.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteDocument the intended scheme at each hop
| Hop | Expected protocol | Evidence to inspect |
|---|---|---|
| Browser to front end | HTTPS for the public URL. | Browser address bar and the first response’s certificate. |
| Front end to Nginx | HTTP or HTTPS, but intentionally chosen. | Listener port and the proxy’s forwarded-scheme setting. |
| Nginx to application | Usually HTTP on a private network. | X-Forwarded-Proto, Host, and upstream access logs. |
Configure the front end to send the original host and scheme, configure Nginx to preserve or translate them deliberately, and configure the application to trust only known proxy addresses. A mismatch at any one hop can produce the same visible loop as a bad Nginx rule.
A practical repair procedure
- Save the current configuration and note the active include files shown by
nginx -T. - Test DNS and capture headers with both HTTP and HTTPS
curl -Irequests. - Identify the exact block selected for the hostname. Correct
listen 443 ssl,server_name, and default-server ordering. - Move any unconditional HTTP-to-HTTPS
return 301out of the 443 block and into the port 80 block. - Validate certificate contents, key pairing, chain order, and file permissions.
- Confirm the 443
locationserves files or proxies the application instead of ending at a redirect. - Pass
HostandX-Forwarded-Prototo the upstream, and configure trusted-proxy handling in the application. - Inspect upstream
Locationheaders. Add a narrowly scopedproxy_redirectonly when the upstream URL cannot be corrected at its source. - Review every rewrite and conditional return for host, scheme, and path cycles. Remember that ten repeated rewrite cycles result in a 500 response.
- Run
nginx -t, reload, and repeat the header tests. Clear browser HSTS or redirect cache only after the server response is correct; caching can otherwise obscure the result.
Verification checklist after the fix
curl -I http://example.com/pathreturns one intentional 301 to the HTTPS version of the same path.curl -I https://example.com/pathreturns the application’s response or one documented application redirect, not an endless chain.- The HTTPS certificate names the requested host and validates without
-k. - The response does not expose an internal hostname, private port, or plain-HTTP
Locationunless that downgrade is deliberate. - Requests to aliases either serve the canonical host or redirect once to it.
- Health checks use the protocol and port expected by the listener, so a 497 is not generated.
- Logs show the request reaching the intended 443 server and, when proxied, the intended upstream.
Choosing the smallest correct fix
Classify the first wrong response before editing. A wrong certificate or unexpected default host is a listener and server_name problem. A handshake or key error is a TLS-file problem. A 301 from the 443 block is redirect logic. An HTTP Location from the application is an upstream scheme or proxy_redirect problem. A 497 is a protocol mismatch at the listener. Fixing the layer that emitted the response avoids masking the issue with extra redirects and preserves a configuration that is easier to operate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
