CKAN 2.9.2: https issues with Let's Encrypt

[maxclac]

CKAN version
2.9.2

Describe the bug
My CKAN instance was installed from source on a VM with Ubuntu 20.04 and Let's Encrypt certificates. I have an address with https: https://example.ckan.com

When I am trying to log in, I get a "Unable to connect" message from Firefox. The URL in the address bar looks like this:

http://example.ckan.com/user/logged_in?came_from=%2Fuser%2Flogged_in&__logins=0

The https is gone obviously. I have the same behavior in Chromium. Things work again as expected when I replace manually the http with https.

A similar thing happens when I try to log out:

http://example.ckan.com/user/logout?came_from=/user/logged_out_redirect

This happens actually all the time, not just for logins and logouts.

I suspect there is something wrong with the redirection to https in Nginx, or the authorizations in /etc/nginx and /etc/letsencrypt.
Unfortunately, I could not find any log with more information about the issue and I have not encountered this problem on the other instances I am running.

Steps to reproduce
See above

Expected behavior
Https should work at all time.

Any idea?

My Nginx conf file:

proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache:30m max_size=250m;
proxy_temp_path /tmp/nginx_proxy 1 2;

server {
    client_max_body_size 100M;
    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/example.ckan.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.ckan.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;

    # Redirect non-https traffic to https
    if ($scheme != "https") {
        return 301 https://$host$request_uri;
    }

    location / {
        proxy_pass http://127.0.0.1:8080/;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $host;
        proxy_cache cache;
        proxy_cache_bypass $cookie_auth_tkt;
        proxy_no_cache $cookie_auth_tkt;
        proxy_cache_valid 30m;
        proxy_cache_key $host$scheme$proxy_host$request_uri;
        # In emergency comment out line to force caching
        # proxy_ignore_headers X-Accel-Expires Expires Cache-Control;
    }

}

[sagargg-zz]

@maxclac Maybe you've forgotten to set ckan.site_url with https on your config file. ckan.site_url = https://example.ckan.com.
https://docs.ckan.org/en/2.9/maintaining/configuration.html#site-settings

[maxclac]

Thanks! It's true that I still had http and not https. It's corrected now, but the problem remains, although I restarted CKAN and Nginx.

[maxclac]

Any idea, anyone?

[jqnatividad]

It may be just a nginx/ssl config issue independent of CKAN...

Have you tried https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-20-04

[maxclac]

I installed Let's Encrypt with these instructions. When I simply type example.ckan.com in the browser, it is adding https without problem. The problem comes with other kind of URLs, e.g. when I log in or log out. Could it be as well a problem of ownerships of some directories?

[maxclac]

This is now solved. I just needed to add this line:

    server_name *.example.ckan.com example.ckan.com;

to the server block in the Nginx configuration.
By the way, it seems that it is not necessary to replace http with https for the ckan.site_url parameter in the ckan.ini file. Both work equally.

[maxclac]

Hi everyone!

Unfortunately, I need to come back to this question, as it seems that the problem persists for logins and logouts, despite having added the line mentioned in the comments above. I have difficulties to believe that it is purely an nginx/ssl problem.

Any idea about this? How can I troubleshoot it?

Best regards

[jpadrianoGo]

proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache:30m max_size=250m;
proxy_temp_path /tmp/nginx_proxy 1 2;

server {
client_max_body_size 100M;
server_name examplei.org www.example.org;
location / {
proxy_pass http://127.0.0.1:8080/; proxy_set_header Host $host;
proxy_cache cache;
proxy_cache_bypass $cookie_auth_tkt;
proxy_no_cache $cookie_auth_tkt;
proxy_cache_valid 30m;
proxy_cache_key $host$scheme$proxy_host$request_uri;
# In emergency comment out line to force caching
# proxy_ignore_headers X-Accel-Expires Expires Cache-Control;
}

listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
if ($host = www.example.org) {
return 301 https://$host$request_uri;
} # managed by Certbot

if ($host = example.org) {
    return 301 https://$host$request_uri;
} # managed by Certbot

server_name example.org www.example.org;
listen 80;
return 404; # managed by Certbot

}

[maxclac]

Thank you for your help! I am not sure how to understand what you wrote. Shouldn't there be a location block in the server block as well?

[jpadrianoGo]

updated reply

[jpadrianoGo]

open port 443

[maxclac]

It looks like it's working. Thanks! This nginx configuration is always black magic for me.