title: Nginx redirect 301 non-ssl www to ssl www no working properly
body: <p>This is a rare case:</p>
  
  <p>We'are using <code>nginx version: nginx/1.10.3 (Ubuntu)</code></p>
  
  <p>In our website the following redirects are working:</p>
  
  <pre><code>http://example.net -&gt; https://www.example.net [WORKING]
  https://example.net -&gt; https://www.example.net [WORKING]
  </code></pre>
  
  <p>However, this redirect is not working at all:</p>
  
  <pre><code>http://www.example.net -&gt; https://www.example.net [NOT WORKING]
  </code></pre>
  
  <p>Here's our configuration:</p>
  
  <pre><code>server {
      listen  80;
      listen  [::]:80;
      server_name     www.example.net;
      return 301 https://www.example.net$request_uri;
  }
  
  server {
      listen 80;
      listen [::]:80;
      server_name    _;
      return         301 https://www.example.net$request_uri;
  }
  
  server {
      listen 443;
      listen [::]:443;
      server_name    example.net;
      return         301 https://www.example.net$request_uri;
  }
  
  server {
      listen 443 default_server ssl http2;
      listen [::]:443 default_server ssl http2;
      server_name www.example.net;
      server_tokens off;
      more_set_headers 'Server: EMET';
  
      ssl    on;
      ssl_certificate    /etc/letsencrypt/live/example.net/fullchain.pem;
      ssl_certificate_key   /etc/letsencrypt/live/example.net/privkey.pem;
  
      ssl_dhparam /etc/ssl/certs/dhparam.pem;
  
      ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
      ssl_prefer_server_ciphers on;
      ssl_ecdh_curve  secp384r1;
      ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:ECDH+AESGCM:ECDH+AES256:DH+AESGCM:DH+AES256:!RS$
  
      ssl_session_cache shared:TLS:2m;
  
      ssl_stapling on;
      ssl_stapling_verify on;
      resolver 8.8.8.8;
  
      add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
      add_header X-Frame-Options DENY;
      add_header X-XSS-Protection "1; mode=block";
  
      root /var/www/html/public;
  
      index index.php;
  
      location / {
              try_files $uri $uri/ /index.php?$query_string;
      }
  
      location ~ \.php$ {
             try_files $uri /index.php =404;
             fastcgi_split_path_info ^(.+\.php)(/.+)$;
             fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
             fastcgi_index index.php;
             fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
             include fastcgi_params;
      }
  
  }
  </code></pre>
  
  <p>In fact, we I do <code>curl -sv http://www.example.net</code> it seems that it hits the https server block. I know that because, as you can see in the configuration above, in nginx I configured the Server header with the string "EMET" only for the <a href="https://www.example.net" rel="nofollow noreferrer">https://www.example.net</a> domain. However, when I do <code>curl -sv http://www.example.net</code> the string appears in the server's answer. </p>
  
  <pre><code>curl -sv http://www.example.net/
  *   Trying 54.85.198.227...
  * TCP_NODELAY set
  * Connected to www.example.net (54.85.198.227) port 80 (#0)
  &gt; GET / HTTP/1.1
  &gt; Host: www.example.net
  &gt; User-Agent: curl/7.54.0
  &gt; Accept: */*
  &gt;
  &lt; HTTP/1.1 200 OK
  &lt; Date: Thu, 19 Apr 2018 19:50:31 GMT
  &lt; Content-Type: text/html; charset=UTF-8
  &lt; Transfer-Encoding: chunked
  &lt; Connection: keep-alive
  &lt; Cache-Control: no-cache, private
  &lt; Server: EMET
  &lt; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  &lt; X-Frame-Options: DENY
  &lt; X-XSS-Protection: 1; mode=block
  </code></pre>
  
  <p>I'll really appreciate your help. </p>
  
  <p>Best regards,</p>