1

I know there are several questions on this issue, but no solutions seems to work for me.

I have Magento 1.9 running on Nginx port 8080 and with Varnish in front running on port 80. Without SSL it's working fine. When I switch to SSL I do the following:

  • Change Varnish to run on port 6081 instead of 80 in /etc/default/varnish.

  • Add two Nginx server blocks, one for terminating SSL and one for redirecting 80 to 443.

  • Update web/secure/base_url and web/unsecure/base_url to use https:// (I do this directly in the database).

Things I've tried:

  • Setting web/secure/use_in_frontend to 1.

  • Adding "SetEnvIf X-Forwarded-Proto https HTTPS=on" to .htaccess (didn't have a htaccess so created one).

Nginx conf with SSL activated (2 top server blocks):

server {
  listen 80;
  server_name www.domain.com domain.com;
  return 301 https://$host$request_uri;
}

server {
  listen 443 ssl;
  server_name www.domain.com domain.com;
  ssl on;
  ssl_certificate /etc/nginx/ssl/www_domain_se/ssl-bundle.crt;
  ssl_certificate_key /etc/nginx/ssl/www_domain_se/myserver.key;
  ssl_protocols              TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers               'AES128+EECDH:AES128+EDH:!aNULL';
  keepalive_timeout 300s;
  location / {
     proxy_pass http://127.0.0.1:6081;
     proxy_set_header X-Real-IP  $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto https;
     proxy_set_header X-Forwarded-Port 443;
     proxy_set_header Host $host;
  }
}

server {
    listen 8080;
    server_name www.domain.com domain.com;
    root /var/www/domain;

    location / {
        index index.html index.php;
        try_files $uri $uri/ @handler;
        expires 30d;
    }

    location ^~ /app/                { deny all; }
    location ^~ /includes/           { deny all; }
    location ^~ /lib/                { deny all; }
    location ^~ /media/downloadable/ { deny all; }
    location ^~ /pkginfo/            { deny all; }
    location ^~ /report/config.xml   { deny all; }
    location ^~ /var/                { deny all; }

    location /var/export/ {
        auth_basic           "Restricted";
        auth_basic_user_file htpasswd;
        autoindex            on;
    }

    location @handler {
        rewrite / /index.php;
    }

    location ~ .php/ {
        rewrite ^(.*.php)/ $1 last;
    }

    location ~ .php$ {
        if (!-e $request_filename) { rewrite / /index.php last; }
        expires        off;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        fastcgi_param  MAGE_RUN_CODE default;
        fastcgi_param  MAGE_RUN_TYPE store;
        fastcgi_read_timeout 300;
        fastcgi_param  HTTPS on;
        include        fastcgi_params;
    }
}

Here's /etc/varnish/default.vcl:

vcl 4.0;

# Default backend definition. Set this to point to your content server.
backend default {
    .host = "127.0.0.1";
    .port = "8080";
    .first_byte_timeout = 300s;
}

sub vcl_recv {
    if (req.method == "PURGE") {
            return (purge);
     }
}

sub vcl_backend_response {
    # Happens after we have read the response headers from the backend.
    #
    # Here you clean the response headers, removing silly Set-Cookie headers
    # and other mistakes your backend does.
}

sub vcl_deliver {
    # Happens when we have all the pieces we need, and are about to send the
    # response to the client.
    #
    # You can do accounting or modifying the final object here.
}

And /etc/default/varnish:

START=yes

NFILES=131072

MEMLOCK=82000

 DAEMON_OPTS=" -a :6081 \
               -T localhost:6082 \
               -f /etc/varnish/default.vcl \
               -S /etc/varnish/secret \
               -p feature=+esi_ignore_other_elements \
               -p cli_buffer=16384 \
               -p vcc_allow_inline_c=on \
               -s malloc,256m"
  • Can you please post your after-SSL-configured Varnish VCL? – Danila Vershinin May 15 '18 at 19:10
  • Added both varnish conf files to the post. – user5747873 May 16 '18 at 5:56
  • My bad. I missed the point that it's M1 and not M2. You shouldn't be really using Varnish with M1. And if you're to use Turpentine, read this – Danila Vershinin May 16 '18 at 7:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.