title: Not allow insecure connections on nginx
body: <p>I installed certbot certificate for nginx:</p>
  
  <pre><code>sudo certbot --nginx -d example.com
  </code></pre>
  
  <p>and redirect all http to https:</p>
  
  <pre><code># Redirect non-https traffic to https
  if ($scheme != "https") {
      return 301 https://$host$request_uri;
  } # managed by Certbot
  </code></pre>
  
  <p>It is working from browser, but I still can make insecure connection via </p>
  
  <pre><code>curl --insecure example.com
  </code></pre>
  
  <p>Here are the main configurations in nginx.conf:</p>
  
  <pre><code>server {
    listen 80;
    server_name example.com;
    if ($scheme != "https") {
       return 301 https://$host$request_uri;
    }
    location / {
      root /www/html/;
      ...
      proxy_pass http://127.0.0.1:80;
    } 
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by 
   Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed 
    by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    proxy_ssl_trusted_certificate /etc/letsencrypt/live/example.com/cert.pem;
    proxy_ssl_verify on;
    proxy_ssl_verify_depth 2;
  }
  </code></pre>
  
  <p>When I issue 
        curl -iI <a href="https://example.com" rel="nofollow noreferrer">https://example.com</a>, it returns:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Server: nginx/1.10.3 (Ubuntu)
  Date: Wed, 04 Jul 2018 09:19:35 GMT
  Content-Type: text/html; charset=UTF-8
  Content-Length: 1218
  Connection: keep-alive
  X-Powered-By: Express
  Accept-Ranges: bytes
  Cache-Control: public, max-age=0
  Last-Modified: Tue, 01 Jul 2018 12:10:25 GMT
  ETag: W/"Zwtf1TTMBhoSbg9LZvHbCg=="
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  </code></pre>