Google .dev domain strangely redirects to httpsNginx or Apache for a VPS?Ruby on Rails - Passenger Nginx - 403 ForbiddenHow do I get ngix to stop listening on port 80?Optimize TOR websiteCan I configure Google Domains to redirect a bare domain to a subdomain over HTTPS?Prevent search bots from indexing server (sub)domain nameWill I get an error message if I ordered a domain name which turns to not be available?Nginx: set Content-Type by URI problemMultiple SSL server blocks with nginx on single ec2 instance“GitHub Pages currently does not support IPv6” when using my domain registered at Google domains
Can we say “you can pay when the order gets ready”?
Which big number is bigger?
Dynamic SOQL query relationship with field visibility for Users
"The cow" OR "a cow" OR "cows" in this context
Was there a Viking Exchange as well as a Columbian one?
Providing evidence of Consent of Parents for Marriage by minor in England in early 1800s?
Alignment of various blocks in tikz
Should the Death Curse affect an undead PC in the Tomb of Annihilation adventure?
What is the philosophical significance of speech acts/implicature?
Don’t seats that recline flat defeat the purpose of having seatbelts?
Minor Revision with suggestion of an alternative proof by reviewer
How to denote matrix elements succinctly?
What is the most expensive material in the world that could be used to create Pun-Pun's lute?
Size of electromagnet needed to replicate Earth's magnetic field
How to not starve gigantic beasts
Check if a string is entirely made of the same substring
How to limit Drive Letters Windows assigns to new removable USB drives
555 timer FM transmitter
What's the name of these pliers?
Elements other than carbon that can form many different compounds by bonding to themselves?
Aliens crash on Earth and go into stasis to wait for technology to fix their ship
Was there a shared-world project before "Thieves World"?
Can I criticise the more senior developers around me for not writing clean code?
Can SQL Server create collisions in system generated constraint names?
Google .dev domain strangely redirects to https
Nginx or Apache for a VPS?Ruby on Rails - Passenger Nginx - 403 ForbiddenHow do I get ngix to stop listening on port 80?Optimize TOR websiteCan I configure Google Domains to redirect a bare domain to a subdomain over HTTPS?Prevent search bots from indexing server (sub)domain nameWill I get an error message if I ordered a domain name which turns to not be available?Nginx: set Content-Type by URI problemMultiple SSL server blocks with nginx on single ec2 instance“GitHub Pages currently does not support IPv6” when using my domain registered at Google domains
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
I bought a .dev domain today @ domains.google. I also set up a dedicated nginx web server to which the .dev domain points (A records).
Very strangely, I can't access my nginx welcome page using my example.dev
domain, because for some weird reason I'm redirected to https://example.dev
which then fails (no connection to my http web server can be established). However, any other domain pointing to this new server works correctly. Like example.com
just works. I didn't configure ANYTHING about nginx, just installed it (the demo config does the job). Obviously enough, this has something to do with Google as the registrar. OK - so I shall contact the Google support, right? Yes. I did that, however, they told me this was something I needed to handle on my side and always referring to 'contact your web host' (which isn't too much of an advice since I'm the host).
I tried everything in the Google console, but I can't get it to work. The Google support was very, very disappointing and I'm now hoping to see some resolutions on this problem.
google nginx debian google-domains
add a comment |
I bought a .dev domain today @ domains.google. I also set up a dedicated nginx web server to which the .dev domain points (A records).
Very strangely, I can't access my nginx welcome page using my example.dev
domain, because for some weird reason I'm redirected to https://example.dev
which then fails (no connection to my http web server can be established). However, any other domain pointing to this new server works correctly. Like example.com
just works. I didn't configure ANYTHING about nginx, just installed it (the demo config does the job). Obviously enough, this has something to do with Google as the registrar. OK - so I shall contact the Google support, right? Yes. I did that, however, they told me this was something I needed to handle on my side and always referring to 'contact your web host' (which isn't too much of an advice since I'm the host).
I tried everything in the Google console, but I can't get it to work. The Google support was very, very disappointing and I'm now hoping to see some resolutions on this problem.
google nginx debian google-domains
add a comment |
I bought a .dev domain today @ domains.google. I also set up a dedicated nginx web server to which the .dev domain points (A records).
Very strangely, I can't access my nginx welcome page using my example.dev
domain, because for some weird reason I'm redirected to https://example.dev
which then fails (no connection to my http web server can be established). However, any other domain pointing to this new server works correctly. Like example.com
just works. I didn't configure ANYTHING about nginx, just installed it (the demo config does the job). Obviously enough, this has something to do with Google as the registrar. OK - so I shall contact the Google support, right? Yes. I did that, however, they told me this was something I needed to handle on my side and always referring to 'contact your web host' (which isn't too much of an advice since I'm the host).
I tried everything in the Google console, but I can't get it to work. The Google support was very, very disappointing and I'm now hoping to see some resolutions on this problem.
google nginx debian google-domains
I bought a .dev domain today @ domains.google. I also set up a dedicated nginx web server to which the .dev domain points (A records).
Very strangely, I can't access my nginx welcome page using my example.dev
domain, because for some weird reason I'm redirected to https://example.dev
which then fails (no connection to my http web server can be established). However, any other domain pointing to this new server works correctly. Like example.com
just works. I didn't configure ANYTHING about nginx, just installed it (the demo config does the job). Obviously enough, this has something to do with Google as the registrar. OK - so I shall contact the Google support, right? Yes. I did that, however, they told me this was something I needed to handle on my side and always referring to 'contact your web host' (which isn't too much of an advice since I'm the host).
I tried everything in the Google console, but I can't get it to work. The Google support was very, very disappointing and I'm now hoping to see some resolutions on this problem.
google nginx debian google-domains
google nginx debian google-domains
edited Apr 21 at 1:12
Fred Stark
1033
1033
asked Apr 19 at 9:36
JohnnyJohnny
9316
9316
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
.dev
domains are HTTPS only. It isn't a redirect. It is HSTS preload.
HSTS is a technology that lets domains declare that they are HTTPS only. It is meant to mitigate against protocol downgrade attacks. The first time you visit a site that wants to use HSTS, you get a header that prevents you from ever visiting that domain on HTTP.
The HSTS preload list is built into web browsers so that the browser knows a site is HTTPS only, even before the first visit. If a site is on the HSTS preload list, it will never be able to be accessed via HTTP in that browser, only via HTTPS.
Google has put the entire .dev
top level domain on the HSTS preload list. That means that no .dev
domain will ever be able run as an HTTP site.
When you registered your .dev
domain, the Google registry told you this on the front page under the "Security benifits" section:
Get built in security
Your security is our priority. The .dev top-level domain is included on the HSTS preload list, making HTTPS required on all connections to .dev websites and pages without needing individual HSTS registration or configuration. Security is built in.
Currently only Firefox and Chrome support this HSTS preload. If you want to be able to test your site before you have HTTPS set up, you could use a different browser. You also might be able to modify your browser settings to disable HSTS.
Because of the HSTS preload, you will need to run your .dev
domain on an HTTPS server so that users can access it.
2
That's it. I must have missed this piece of info, and the support team wouldn't remind me of this fact again (even though I think it's pretty obvious I was missing exactly this info).
– Johnny
Apr 19 at 10:52
8
Yes, support should have been able to tell you this.
– Stephen Ostermiller♦
Apr 19 at 10:54
4
@Johnny btw, you might be interested in Let's Encrypt: letsencrypt.org
– Ave
Apr 20 at 1:32
1
Another Google-created TLD,.app
, is also an HTTPS-only namespace. Beware.
– Alex Jone
Apr 20 at 16:55
4
For dev domains, the two that are reserved are *.test and *.localhost. They are fully reserved, so will never be taken over as real TLDs. *.localhost is actually really nice if you're doing localhost testing, as you can use multiple services like you would with other TLDs, and it still maps to 127.0.0.1. *.test is meant for any dns related stuff, so if you need to map to virtual machine IPs or something, that's your go-to. Lately I've been a big fan of *.localhost with docker containers, since I map the reverse proxy to 127.0.0.1 anyway. Requires no local dns or /etc/hosts shenanigans.
– superlinkx
Apr 20 at 18:43
|
show 12 more comments
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "45"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fwebmasters.stackexchange.com%2fquestions%2f122337%2fgoogle-dev-domain-strangely-redirects-to-https%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
.dev
domains are HTTPS only. It isn't a redirect. It is HSTS preload.
HSTS is a technology that lets domains declare that they are HTTPS only. It is meant to mitigate against protocol downgrade attacks. The first time you visit a site that wants to use HSTS, you get a header that prevents you from ever visiting that domain on HTTP.
The HSTS preload list is built into web browsers so that the browser knows a site is HTTPS only, even before the first visit. If a site is on the HSTS preload list, it will never be able to be accessed via HTTP in that browser, only via HTTPS.
Google has put the entire .dev
top level domain on the HSTS preload list. That means that no .dev
domain will ever be able run as an HTTP site.
When you registered your .dev
domain, the Google registry told you this on the front page under the "Security benifits" section:
Get built in security
Your security is our priority. The .dev top-level domain is included on the HSTS preload list, making HTTPS required on all connections to .dev websites and pages without needing individual HSTS registration or configuration. Security is built in.
Currently only Firefox and Chrome support this HSTS preload. If you want to be able to test your site before you have HTTPS set up, you could use a different browser. You also might be able to modify your browser settings to disable HSTS.
Because of the HSTS preload, you will need to run your .dev
domain on an HTTPS server so that users can access it.
2
That's it. I must have missed this piece of info, and the support team wouldn't remind me of this fact again (even though I think it's pretty obvious I was missing exactly this info).
– Johnny
Apr 19 at 10:52
8
Yes, support should have been able to tell you this.
– Stephen Ostermiller♦
Apr 19 at 10:54
4
@Johnny btw, you might be interested in Let's Encrypt: letsencrypt.org
– Ave
Apr 20 at 1:32
1
Another Google-created TLD,.app
, is also an HTTPS-only namespace. Beware.
– Alex Jone
Apr 20 at 16:55
4
For dev domains, the two that are reserved are *.test and *.localhost. They are fully reserved, so will never be taken over as real TLDs. *.localhost is actually really nice if you're doing localhost testing, as you can use multiple services like you would with other TLDs, and it still maps to 127.0.0.1. *.test is meant for any dns related stuff, so if you need to map to virtual machine IPs or something, that's your go-to. Lately I've been a big fan of *.localhost with docker containers, since I map the reverse proxy to 127.0.0.1 anyway. Requires no local dns or /etc/hosts shenanigans.
– superlinkx
Apr 20 at 18:43
|
show 12 more comments
.dev
domains are HTTPS only. It isn't a redirect. It is HSTS preload.
HSTS is a technology that lets domains declare that they are HTTPS only. It is meant to mitigate against protocol downgrade attacks. The first time you visit a site that wants to use HSTS, you get a header that prevents you from ever visiting that domain on HTTP.
The HSTS preload list is built into web browsers so that the browser knows a site is HTTPS only, even before the first visit. If a site is on the HSTS preload list, it will never be able to be accessed via HTTP in that browser, only via HTTPS.
Google has put the entire .dev
top level domain on the HSTS preload list. That means that no .dev
domain will ever be able run as an HTTP site.
When you registered your .dev
domain, the Google registry told you this on the front page under the "Security benifits" section:
Get built in security
Your security is our priority. The .dev top-level domain is included on the HSTS preload list, making HTTPS required on all connections to .dev websites and pages without needing individual HSTS registration or configuration. Security is built in.
Currently only Firefox and Chrome support this HSTS preload. If you want to be able to test your site before you have HTTPS set up, you could use a different browser. You also might be able to modify your browser settings to disable HSTS.
Because of the HSTS preload, you will need to run your .dev
domain on an HTTPS server so that users can access it.
2
That's it. I must have missed this piece of info, and the support team wouldn't remind me of this fact again (even though I think it's pretty obvious I was missing exactly this info).
– Johnny
Apr 19 at 10:52
8
Yes, support should have been able to tell you this.
– Stephen Ostermiller♦
Apr 19 at 10:54
4
@Johnny btw, you might be interested in Let's Encrypt: letsencrypt.org
– Ave
Apr 20 at 1:32
1
Another Google-created TLD,.app
, is also an HTTPS-only namespace. Beware.
– Alex Jone
Apr 20 at 16:55
4
For dev domains, the two that are reserved are *.test and *.localhost. They are fully reserved, so will never be taken over as real TLDs. *.localhost is actually really nice if you're doing localhost testing, as you can use multiple services like you would with other TLDs, and it still maps to 127.0.0.1. *.test is meant for any dns related stuff, so if you need to map to virtual machine IPs or something, that's your go-to. Lately I've been a big fan of *.localhost with docker containers, since I map the reverse proxy to 127.0.0.1 anyway. Requires no local dns or /etc/hosts shenanigans.
– superlinkx
Apr 20 at 18:43
|
show 12 more comments
.dev
domains are HTTPS only. It isn't a redirect. It is HSTS preload.
HSTS is a technology that lets domains declare that they are HTTPS only. It is meant to mitigate against protocol downgrade attacks. The first time you visit a site that wants to use HSTS, you get a header that prevents you from ever visiting that domain on HTTP.
The HSTS preload list is built into web browsers so that the browser knows a site is HTTPS only, even before the first visit. If a site is on the HSTS preload list, it will never be able to be accessed via HTTP in that browser, only via HTTPS.
Google has put the entire .dev
top level domain on the HSTS preload list. That means that no .dev
domain will ever be able run as an HTTP site.
When you registered your .dev
domain, the Google registry told you this on the front page under the "Security benifits" section:
Get built in security
Your security is our priority. The .dev top-level domain is included on the HSTS preload list, making HTTPS required on all connections to .dev websites and pages without needing individual HSTS registration or configuration. Security is built in.
Currently only Firefox and Chrome support this HSTS preload. If you want to be able to test your site before you have HTTPS set up, you could use a different browser. You also might be able to modify your browser settings to disable HSTS.
Because of the HSTS preload, you will need to run your .dev
domain on an HTTPS server so that users can access it.
.dev
domains are HTTPS only. It isn't a redirect. It is HSTS preload.
HSTS is a technology that lets domains declare that they are HTTPS only. It is meant to mitigate against protocol downgrade attacks. The first time you visit a site that wants to use HSTS, you get a header that prevents you from ever visiting that domain on HTTP.
The HSTS preload list is built into web browsers so that the browser knows a site is HTTPS only, even before the first visit. If a site is on the HSTS preload list, it will never be able to be accessed via HTTP in that browser, only via HTTPS.
Google has put the entire .dev
top level domain on the HSTS preload list. That means that no .dev
domain will ever be able run as an HTTP site.
When you registered your .dev
domain, the Google registry told you this on the front page under the "Security benifits" section:
Get built in security
Your security is our priority. The .dev top-level domain is included on the HSTS preload list, making HTTPS required on all connections to .dev websites and pages without needing individual HSTS registration or configuration. Security is built in.
Currently only Firefox and Chrome support this HSTS preload. If you want to be able to test your site before you have HTTPS set up, you could use a different browser. You also might be able to modify your browser settings to disable HSTS.
Because of the HSTS preload, you will need to run your .dev
domain on an HTTPS server so that users can access it.
edited Apr 19 at 10:13
answered Apr 19 at 10:07
Stephen Ostermiller♦Stephen Ostermiller
70.3k13100255
70.3k13100255
2
That's it. I must have missed this piece of info, and the support team wouldn't remind me of this fact again (even though I think it's pretty obvious I was missing exactly this info).
– Johnny
Apr 19 at 10:52
8
Yes, support should have been able to tell you this.
– Stephen Ostermiller♦
Apr 19 at 10:54
4
@Johnny btw, you might be interested in Let's Encrypt: letsencrypt.org
– Ave
Apr 20 at 1:32
1
Another Google-created TLD,.app
, is also an HTTPS-only namespace. Beware.
– Alex Jone
Apr 20 at 16:55
4
For dev domains, the two that are reserved are *.test and *.localhost. They are fully reserved, so will never be taken over as real TLDs. *.localhost is actually really nice if you're doing localhost testing, as you can use multiple services like you would with other TLDs, and it still maps to 127.0.0.1. *.test is meant for any dns related stuff, so if you need to map to virtual machine IPs or something, that's your go-to. Lately I've been a big fan of *.localhost with docker containers, since I map the reverse proxy to 127.0.0.1 anyway. Requires no local dns or /etc/hosts shenanigans.
– superlinkx
Apr 20 at 18:43
|
show 12 more comments
2
That's it. I must have missed this piece of info, and the support team wouldn't remind me of this fact again (even though I think it's pretty obvious I was missing exactly this info).
– Johnny
Apr 19 at 10:52
8
Yes, support should have been able to tell you this.
– Stephen Ostermiller♦
Apr 19 at 10:54
4
@Johnny btw, you might be interested in Let's Encrypt: letsencrypt.org
– Ave
Apr 20 at 1:32
1
Another Google-created TLD,.app
, is also an HTTPS-only namespace. Beware.
– Alex Jone
Apr 20 at 16:55
4
For dev domains, the two that are reserved are *.test and *.localhost. They are fully reserved, so will never be taken over as real TLDs. *.localhost is actually really nice if you're doing localhost testing, as you can use multiple services like you would with other TLDs, and it still maps to 127.0.0.1. *.test is meant for any dns related stuff, so if you need to map to virtual machine IPs or something, that's your go-to. Lately I've been a big fan of *.localhost with docker containers, since I map the reverse proxy to 127.0.0.1 anyway. Requires no local dns or /etc/hosts shenanigans.
– superlinkx
Apr 20 at 18:43
2
2
That's it. I must have missed this piece of info, and the support team wouldn't remind me of this fact again (even though I think it's pretty obvious I was missing exactly this info).
– Johnny
Apr 19 at 10:52
That's it. I must have missed this piece of info, and the support team wouldn't remind me of this fact again (even though I think it's pretty obvious I was missing exactly this info).
– Johnny
Apr 19 at 10:52
8
8
Yes, support should have been able to tell you this.
– Stephen Ostermiller♦
Apr 19 at 10:54
Yes, support should have been able to tell you this.
– Stephen Ostermiller♦
Apr 19 at 10:54
4
4
@Johnny btw, you might be interested in Let's Encrypt: letsencrypt.org
– Ave
Apr 20 at 1:32
@Johnny btw, you might be interested in Let's Encrypt: letsencrypt.org
– Ave
Apr 20 at 1:32
1
1
Another Google-created TLD,
.app
, is also an HTTPS-only namespace. Beware.– Alex Jone
Apr 20 at 16:55
Another Google-created TLD,
.app
, is also an HTTPS-only namespace. Beware.– Alex Jone
Apr 20 at 16:55
4
4
For dev domains, the two that are reserved are *.test and *.localhost. They are fully reserved, so will never be taken over as real TLDs. *.localhost is actually really nice if you're doing localhost testing, as you can use multiple services like you would with other TLDs, and it still maps to 127.0.0.1. *.test is meant for any dns related stuff, so if you need to map to virtual machine IPs or something, that's your go-to. Lately I've been a big fan of *.localhost with docker containers, since I map the reverse proxy to 127.0.0.1 anyway. Requires no local dns or /etc/hosts shenanigans.
– superlinkx
Apr 20 at 18:43
For dev domains, the two that are reserved are *.test and *.localhost. They are fully reserved, so will never be taken over as real TLDs. *.localhost is actually really nice if you're doing localhost testing, as you can use multiple services like you would with other TLDs, and it still maps to 127.0.0.1. *.test is meant for any dns related stuff, so if you need to map to virtual machine IPs or something, that's your go-to. Lately I've been a big fan of *.localhost with docker containers, since I map the reverse proxy to 127.0.0.1 anyway. Requires no local dns or /etc/hosts shenanigans.
– superlinkx
Apr 20 at 18:43
|
show 12 more comments
Thanks for contributing an answer to Webmasters Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fwebmasters.stackexchange.com%2fquestions%2f122337%2fgoogle-dev-domain-strangely-redirects-to-https%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown