Otdfbt

I'm trying to redirect my domain to another domain but keeping my domain in the URL.

This is my settings:

server 
 listen 443 ssl;
 listen [::]:443 ssl;

 server_name example.com;
 root /home/redacted/redacted/wwwdir;

 # SSL
 ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
 ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
 ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

 # reverse proxy
 location / 
 proxy_pass https://example2.com/ID/;
 

 # Block google
 location = /robots.txt 
 add_header Content-Type text/plain;
 return 200 "User-agent: *nDisallow: /n";
 




# HTTP redirect
server 
 listen 80;
 listen [::]:80;

 server_name .example.com;

 location / 
 return 301 https://example.com$request_uri;
 

But I'm seeing errors like this in my logs:

2019/05/31 18:35:48 [crit] 14831#14831: *2415 SSL_do_handshake() failed (SSL: error:14090072:SSL routines:SSL3_GET_SERVER_CERTIFICATE:bad message type) while SSL handshaking to upstream, client: IP, server: example.com, request: "GET /templates/js/jquery.nestable.js HTTP/1.1", upstream: "https://IP:443/ID/templates/js/jquery.nestable.js", host: "example.com", referrer: "https://example.com/admin/index.php"

I think the issue here is upstream:"https://IP:443/ID/templates/js/jquery.nestable.js"

Why is using IP:443 here?

When connecting to a backend/upstream using https, Nginx defaults to using client certificate authentication: it expects you to give it a certificate that has been signed by your upstream certificate (see https://docs.nginx.com/nginx/admin-guide/security-controls/securing-http-traffic-upstream/).

As far as I understand this is not what you want; you only want to secure the communication between Nginx and the upstream, not authenticate/authorize it.

I had the same issue a while ago; if I remember correctly, adding proxy_ssl_verify off; next to the proxy_pass ... directive fixed it.