重定向错误（在 certbot 更新/nginx 之后）

Question

This configuration for my webserver works partly (actual Ubuntu). If the newest Firefox uses the site with a smartphone, it results in a redirection error. Some other browsers may work, but not reliable. I tried to delete the browser cache and restarted/reloaded the nginx-server. Is there an error in the NGINX-config? The problem first occurred, when I renewed the SSL certs with certbot. Thank you!

    server {
        listen 443 ssl;
        listen [::]:443 ssl;
    
        # SSL configuration
        #
        # listen 443 ssl default_server;
        # listen [::]:443 ssl default_server;
        #
        # Note: You should disable gzip for SSL traffic.
        # See: https://bugs.debian.org/773332
        #
        # Read up on ssl_ciphers to ensure a secure configuration.
        # See: https://bugs.debian.org/765782
        #
        # Self signed certs generated by the ssl-cert package
        # Don't use them in a production server!
        #
        # include snippets/snakeoil.conf;    
    
        server_name sozcafe.de;     
        
        location / {
            root /var/www/html;
            index index.php;
            try_files $uri $uri/ @rewrite;
        }
        
        location @rewrite {
            rewrite ^/(forum/|chat/|cms/|wcf/|calendar/|filebase/|blog/|gallery/)?([^.]+)$ /$1index.php?$2 last;
        }
        ssl_certificate /etc/letsencrypt/live/sozcafe.de/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/sozcafe.de/privkey.pem; # managed by Certbot
        
        #ssl_certificate /etc/letsencrypt/live/www.coffeecat.de/cert.pem;
        #ssl_certificate_key /etc/letsencrypt/live/www.coffeecat.de/privkey.pem;
        
        # pass PHP scripts to FastCGI server
        #
        location ~ \.php$ {
            root /var/www/html;
            index index.php;
            include snippets/fastcgi-php.conf;  
        
            
            
        #
        #   # With php-fpm (or other unix sockets):
            fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
        #   # With php-cgi (or other tcp sockets):
        #   fastcgi_pass 127.0.0.1:9000;
        }
    
        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #   deny all;
        #}
    
    
    }
    
    server {
        
        server_name sozcafe.de www.sozcafe.de;
        return 301 https://$server_name$request_uri;
        
    
        listen [::]:443 ssl ipv6only=on; # managed by Certbot
        listen 443 ssl; # managed by Certbot
        ssl_certificate /etc/letsencrypt/live/sozcafe.de/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/sozcafe.de/privkey.pem; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    
    
    }
    
    server {
        if ($host = www.sozcafe.de) {
            return 301 https://$host$request_uri;
        } # managed by Certbot
    
    
        if ($host = sozcafe.de) {
            return 301 https://$host$request_uri;
        } # managed by Certbot
    
    
        listen 80;
        listen [::]:80;
        
        server_name sozcafe.de www.sozcafe.de;
        return 404; # managed by Certbot
    
    }

Answer 1

Looking carefully in your config file you can figure out that you are listening for the same port ( 443 ), the same server name ( sozcafe.de ) in two of your server blocks, the first and second one to be more specific. Having the statement return 301 https://$server_name$request_uri in the second server block of your config causes an effect of "infinite loop" because nginx always redirects to this server block each time you access to your domain.

I suspect Certbot added one of those when you ran it.

You can solve it by deleting sozcafe.de in your second server block to redirect only the www domain instead the target domain itself.

    server {
        
        # server_name sozcafe.de www.sozcafe.de;
        server_name www.sozcafe.de;
        return 301 https://$server_name$request_uri;
        
    
        listen [::]:443 ssl ipv6only=on; # managed by Certbot
        listen 443 ssl; # managed by Certbot
        ssl_certificate /etc/letsencrypt/live/sozcafe.de/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/sozcafe.de/privkey.pem; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    
    
    }