PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Most Nginx HTTPS redirect failures come from mixing two jobs: redirecting clear-text HTTP and serving the encrypted request. Keep an HTTP server block on port 80 that returns one permanent redirect, then let the port-443 block terminate TLS and serve or proxy the application. Verify that the 443 block has the intended server_name, listen 443 ssl, matching certificate and key, and no unconditional redirect. If the application still returns an HTTP Location header, correct the forwarded scheme or rewrite that header with proxy_redirect.
The procedure below separates listener selection, TLS, redirect rules, reverse-proxy headers and upstream behavior. That makes it possible to change only the layer producing the wrong response instead of adding another redirect and deepening a loop.
The correct Nginx layout for HTTP and HTTPS
A working setup normally has two server blocks. Port 80 receives an ordinary HTTP request and sends it to the public HTTPS URL. Port 443 negotiates TLS and then serves files or proxies the request to an application.
| Listener | Purpose | What it should return |
|---|---|---|
| Port 80 | Accept clear-text HTTP | A single 301 redirect to the HTTPS URL, preserving the request URI |
| Port 443 | Terminate TLS and handle the secure request | Application content, a proxied response, or an application-level redirect—not an unconditional HTTP-to-HTTPS redirect |
This is a minimal reverse-proxy pattern. Replace the certificate paths and upstream name with the values used on your host.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
server {
listen 80;
server_name example.com www.example.com;
return 301 https://example.com$request_uri;
}
server {
listen 443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/nginx/tls/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/privkey.pem;
location / {
proxy_pass http://app;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Nginx’s HTTPS guidance requires the ssl parameter on the listening socket and paths to the server certificate and private key. The SSL module uses OpenSSL. On a static site, replace the proxy_pass location with a normal root and try_files configuration; the separation between ports remains the same.
Start by measuring the redirect chain
Do not infer the failing layer from a browser’s final error page. Capture each response and its exact Location header first.
- Confirm that DNS for the hostname points to the machine or front-end you intend to troubleshoot.
- Run
curl -I http://example.com. The expected result is one301whoseLocationbegins withhttps://and contains the original path and query string. - Run
curl -I https://example.com. This tests certificate validation and the HTTPS response. - If certificate validation is the only question, run
curl -k -I https://example.com. The-koption deliberately ignores certificate validation; it must not be used to declare a production certificate healthy. - Follow the chain when necessary with
curl -I -L http://example.com, but also inspect each individual response so that a repeated pair of URLs is visible.
Record the status code, the complete Location value, and whether the scheme changes on every hop. A loop between the same HTTPS URL and an HTTP URL usually points to proxy scheme handling or an upstream redirect. A loop that never reaches the application can be caused by a return directive in the 443 block.
| Observed response | Likely layer | First check |
|---|---|---|
| HTTP returns 301 to HTTPS, then HTTPS returns another 301 to the same HTTPS URL | Redirect rule in the secure server block or an upstream redirect | Search the 443 block and inspect the upstream Location |
| HTTPS returns a 301 back to HTTP | Application or proxy believes the request is HTTP | X-Forwarded-Proto, front-end scheme headers and proxy_redirect |
| Certificate warning or handshake failure before an HTTP status | TLS certificate, key, chain or listener selection | nginx -t, certificate paths and the selected server_name |
| Status 497 | Plain HTTP was sent to an HTTPS listener | Correct the client, load balancer or listener receiving the request |
| Status 500 after repeated rewrites | Rewrite processing exceeded Nginx’s cycle limit | Review rewrite, return and last directives |
Validate the configuration Nginx is actually using
Editing a file is not the same as changing the active configuration. Test and print the loaded configuration before changing redirect logic.
sudo nginx -t
sudo nginx -Tnginx -t checks syntax and reports startup problems such as a certificate/key mismatch. nginx -T prints the complete configuration Nginx has loaded, including files pulled in with include. Use it to find an older server block, an inherited return, or a second default listener that is answering instead of the block you edited.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
For the requested hostname, verify all of the following in the active dump:
Free tools Windows power users keep installed
One-click scans. No signup required.
- The intended 443 block contains the exact hostname in
server_name. - It listens with
listen 443 ssl, not onlylisten 443. - There is only one intended default server for port 443, unless you have deliberately designed a more complex selection scheme.
- The port-80 block is the one issuing the HTTP-to-HTTPS redirect.
- The 443 block contains a serving or proxying
locationrather than an unconditional redirect.
After a successful test, reload Nginx using the service method provided by your operating system. If the test fails, do not reload a broken configuration; fix the reported file and line first.
Fix the port-443 listener and server-name selection
Use the right TLS listener
The secure block must explicitly enable TLS on its listening socket:
listen 443 ssl;If a front-end proxy passes traffic to Nginx, determine whether Nginx receives encrypted traffic or already-decrypted HTTP. In the first design, Nginx needs the certificate and the ssl listener. In the second, the front end terminates TLS and Nginx may receive HTTP on an internal listener; adding a second HTTPS redirect without preserving the original scheme can create a loop.
Make SNI and server_name agree
Nginx chooses among name-based virtual servers using the requested hostname and TLS server-name information. A request sent to a hostname absent from the 443 server_name list can land in the default server, presenting the wrong certificate or the wrong redirect policy. Compare the hostname used in the browser and in curl with the names declared in the active block. Include the bare domain and the www name only when both are intended to work.
Recommended Free Tools
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Testing an IP address instead of the hostname can select a different certificate and server block. Test the real hostname, and ensure DNS has finished pointing at the intended endpoint before judging the Nginx configuration.
Repair certificate, key and chain problems
A redirect cannot be evaluated if TLS negotiation fails first. Check the certificate and key paths in the 443 block and run nginx -t. Nginx reports a key values mismatch when the private key does not correspond to the certificate.
The certificate file should contain the server certificate first, followed by the intermediate certificates that form the chain. Incorrect ordering can cause startup errors or leave clients unable to build a trusted chain even though the leaf certificate itself appears valid. Do not put the private key into the certificate bundle.
When testing a suspected certificate problem, compare a normal request with a deliberately insecure diagnostic request:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →curl -I https://example.com
curl -k -I https://example.comIf the second command reaches an HTTP response while the first fails validation, the redirect rules are not the immediate problem; repair trust, hostname coverage or chain delivery first. If both commands receive a redirect, continue with HTTP-layer troubleshooting.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Remove an unconditional redirect from the HTTPS block
The most direct redirect loop is a 443 server block that contains the same unconditional return 301 intended for port 80:
server {
listen 443 ssl;
server_name example.com;
return 301 https://example.com$request_uri;
}Every request that reaches this block is redirected again, including requests that are already HTTPS. Remove that return from the secure block and restore the real location / that serves or proxies the site. Keep the redirect only in the port-80 block.
An Nginx mailing-list troubleshooting answer summarizes the correction as removing the return directive and restoring the proxy location. This is a configuration correction, not a browser-cache fix: clear caches only after the server returns the correct response.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsCorrect reverse-proxy scheme and upstream redirects
When Nginx terminates TLS and forwards to an application over HTTP, the upstream connection’s scheme is HTTP even though the visitor used HTTPS. Applications that build absolute URLs from that connection can send a redirect back to HTTP, producing a loop:
location / {
proxy_pass http://app;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
}For a direct HTTPS request to Nginx, $scheme is https, so the application can generate secure URLs. If another trusted proxy sits in front of Nginx, make sure its scheme header is passed through according to your architecture; do not blindly trust a client-supplied header from the public Internet.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Rewrite an upstream Location header when necessary
An application may return a valid redirect whose host, port or scheme is internal—for example, an HTTP URL that visitors cannot use. Nginx’s proxy_redirect directive changes the Location and Refresh headers in a proxied response before they reach the client.
location / {
proxy_pass http://app;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect http://app/ https://example.com/;
}Use a rewrite that matches the URL the upstream actually emits and replaces it with the public URL. Inspect the raw response first; otherwise it is easy to rewrite the wrong host, port or path and create a new loop. If the application can be configured to generate the correct public URL itself, that is usually preferable to a broad header rewrite.
Find rewrite rules that reprocess the request
Nginx can issue redirects with return or rewrite ... permanent. Internal rewrites can also send a request through location selection again. The rewrite module limits repeated processing to 10 cycles; after that, Nginx returns status 500.
Inspect every rewrite affecting the hostname and path, including snippets included from other files. Pay particular attention to:
- A
rewritethat changes a URL into one matched by the same rule. lastused where an internal redirect immediately selects the same location again.- A permanent rewrite in the 443 block that points to a URL handled by an identical rule.
- Trailing-slash, host-normalization and HTTP-to-HTTPS rules duplicated at several layers.
Temporarily reduce the path to one explicit redirect on port 80 and one serving rule on port 443. Once the two basic requests return the expected responses, add application-specific rewrites one at a time and retest the chain.
Account for a load balancer or TLS-terminating front end
A front-end proxy changes which component sees TLS. If it terminates HTTPS and forwards HTTP to Nginx, Nginx must receive a reliable indication that the original request was secure. Otherwise Nginx or the application may redirect the request to HTTPS on every pass, while the front end repeats the same HTTP-to-Nginx hop.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Map the path explicitly:
- Identify where the client’s TLS session terminates.
- Record the protocol used on each hop after termination.
- Confirm which component sets and preserves the original scheme header.
- Configure Nginx and the application to trust that header only from the known front end.
- Ensure only the edge-facing HTTP listener performs the public HTTP-to-HTTPS redirect.
If TLS is passed through unchanged to Nginx, troubleshoot the certificate and 443 server block there. If TLS terminates upstream, troubleshoot forwarding headers and the internal listener instead of adding another certificate or redirect to an HTTP-only hop.
A repeatable repair workflow
- Capture responses. Use the four
curlrequests above and write down every status andLocation. - Confirm endpoint ownership. Check DNS and any front-end proxy so you are editing the machine that answers the request.
- Print active configuration. Run
nginx -tandnginx -T; locate all 80 and 443 server blocks for the hostname. - Fix selection. Correct
server_name, the intended 443 default behavior and thelisten 443 ssldeclaration. - Fix TLS. Point to the matching key and certificate, with the server certificate before intermediates.
- Separate responsibilities. Leave one HTTP-to-HTTPS
return 301on port 80; remove any unconditional equivalent from port 443. - Restore serving logic. Ensure the 443 block has the correct static location or reverse-proxy location.
- Fix scheme forwarding. Set
proxy_set_header X-Forwarded-Proto $schemewhen Nginx terminates TLS, and align any trusted front-end headers. - Inspect upstream redirects. If the application emits an internal URL, correct its public URL settings or apply a narrowly scoped
proxy_redirect. - Retest after each change. Run
nginx -t, reload only after a successful test, then repeat the individualcurlrequests.
Common failure patterns and their smallest fixes
| Failure pattern | Smallest appropriate fix | Why a larger change is unnecessary |
|---|---|---|
| Port 80 does not redirect | Put one return 301 https://...$request_uri in the matching port-80 block |
TLS settings do not affect an HTTP request that never reaches port 443 |
| Port 443 repeats the same HTTPS URL | Remove the unconditional 443 return and restore the serving location |
The listener is working; its response policy is wrong |
| HTTPS changes back to HTTP after proxying | Correct forwarded-scheme handling or rewrite the upstream Location |
Adding another public redirect cannot make an upstream HTTP URL secure |
| Wrong certificate for the hostname | Fix DNS, SNI and the selected server_name or default server |
Changing application redirects cannot change which TLS block answers |
| Nginx will not reload with a key mismatch | Use the matching private key and order the certificate chain correctly | HTTP diagnostics cannot run until Nginx can load the TLS configuration |
| 500 after many internal rewrites | Remove the self-matching rule or incorrect last flow |
The ten-cycle limit is a rewrite loop, not a certificate problem |
| 497 on port 443 | Send HTTPS to that port, or route plain HTTP to a port-80 listener | 497 indicates a protocol mismatch before normal application redirect handling |
What status 497 means
Status 497 is Nginx’s indication that a regular HTTP request was sent to an HTTPS port. It is not evidence that the application issued a bad redirect. Correct the caller, health check, load balancer or front-end listener so that clear-text traffic goes to port 80 and TLS traffic goes to port 443. If a front end intentionally forwards decrypted HTTP to an internal Nginx listener, use that internal port rather than sending the request to the TLS socket.
Quick Recap
Final verification checklist
curl -I http://example.comreturns one permanent redirect to the intended HTTPS hostname and preserves the path.curl -I https://example.comreaches the expected site or application without cycling.- The 443 block contains
listen 443 ssl, the correctserver_name, a matching key and certificate, and a correctly ordered chain. - The 443 block serves or proxies the request instead of issuing an unconditional redirect.
- Proxy requests identify the original scheme with
X-Forwarded-Protowhere the application needs it. - Any
proxy_redirectrule matches the upstream URL actually present in the response. - No rewrite path re-enters itself; repeated processing stays below Nginx’s ten-cycle limit.
- A request sent to port 443 is TLS, not plain HTTP, and any front-end proxy preserves the intended scheme.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
