It looks like you are trying to connect to your droplet’s database from outside of your droplet now. Am I right ? In that case, you should follow @alexdo’s answer.

Not really, this was more of an SSL issue, as whenever I tried connecting to DB it connected to the https://domain.com:5432 rather than connecting to http://domain.com:5432 - I solved it by first installing the app then SSL :)

Please, specify the exact reason for that redirection. The solution strongly depends on that.

I have an app (public facing) on http://domain.com:6000 which has various sub URLs like

http://domain.com:6000/subscribe/3423-23452345-fsd-a345-234

and

http://domain.com:6000/unsubscribe/341234-2345-fasdf-1453245 etc.

These URLs are also sent out to subscribers via email and when they are clicked by customers the insecure version (http) with port number open up which really does not look secure and neat. Thus I need to move them to

https://domain.com/subscribe/3423-23452345-fsd-a345-234

and

https://domain.com/unsubscribe/341234-2345-fasdf-1453245

with the action of both the URLs remaining unaffected. I feel this needs to be achieved out of server block setting of nginx, but unable to find a working solution for the same.

@yannek - I just commented from my other account above :) Can you pls help?

@Yannek : Can you point me to the relevant tutorial pls? Also, can installing nginx/apache interfere with the running application as that app does not require these running.

Hi,

Usually when you will have a SSL installed for a domain name it will be needed for a website which requires a web server like Apache/Nginx, hence you might find only articles on how to install SSL for domain name on a Apache/Nginx Ubuntu/CentOS droplets.

Hope that this helps!
Regards,
Alex

@alexdo : Can you pls help me to to do the below:

http://domain.com:9000/x/x to be redirected to https://domain.com/x/x

and

https://domain.com:9000/x/x to be redirected to https://domain.com/x/x

That is what I would do - setting up nginx reverse proxy for the app.
I would…

1. Set up the app for listening on 127.0.0.1:6000 only (localhost:6000).

2. Configure server block in nginx to listen on port 6001, serving SSL/TLS connection and reverse proxy for the app.

3. Configure server block in nginx to listen on port 6000 and to redirect incoming connections to https on port 6001

Those server block configurations would look like

server {
  listen droplet_public_ip:6001 ssl;
  server_name domain.com;

  location / {
    proxy_pass http://localhost:6000;
    proxy_redirect http://localhost:6000 https://domain.com:6001;
  }

  ssl on;
  ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;
  include /etc/letsencrypt/options-ssl-nginx.conf;
}

server {
    listen droplet_public_ip:6000;
    server_name domain.com;
    return 301 https://domain.com:6001$request_uri;
    return 404;
}

And if I ran

sudo netstat -tulpn | grep -e 6000 -e 6001

the result would look like

Output
tcp  0  0  127.0.0.1:6000   0.0.0.0:*  LISTEN  39360/app         
tcp  0  0  1.2.3.4:6001     0.0.0.0:*  LISTEN  39591/nginx
tcp  0  0  1.2.3.4:6000     0.0.0.0:*  LISTEN  39591/nginx

I hope you actually do not use port tcp 6000. Communication on this port is blocked by default in some internet browsers (e.g. Firefox, SeaMonkey).
Do not forget to open port tcp 6001 in your firewall :)

Let me know if it works, pls.

@Yannek : Thanks for taking out time to write such a detailed response.

Here’s where I am:

• the auto email shot by the app now actually contains url with port number
• the auto email shot by the app now actually contains url without https

and the url works as it should

• app does not load on https (says ssl error)
• neither is the port gone from the login url of the app

sudo netstat -tulpn | grep -e 6000 -e 6001 

resulted in below
tcp 0 0 1.2.3.4:6000 0.0.0.0:* LISTEN 24317/./appname

Those server block configurations would look like

sudo nginx -t
nginx: [warn] the “ssl” directive is deprecated, use the “listen … ssl” directive instead in /etc/nginx/sites-enabled/domain.com:48
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

anything that I did wrong?

Or was I supposed to add it to some other file? Or maybe creating sym link?

This configuration should work finally but it is a bit weird. I strongly recommend you documenting it well to avoid any doubts in the future when you will have to reconfigure website/app environment :)

Short explanation of this configuration.
The app listens on public IP address, port 6000 but the firewall rule redirects traffic from port 6000 to 6003. So, HTTP requests, originally addressed to port 6000, come to port 6003, and they are served by Nginx listening on this port. Nginx rewrites their protocol scheme to HTTPS and starts the SSL/TSL sessions on port 6001. Nginx redirect traffic from port 6001 to the app (port 6000), decrypting it to HTTP, as it is reverse proxy for the app.

Here are the steps to do:

1. Set up Nginx

Modify nginx server block to get it as below

server {
  listen droplet_public_ip:6001 ssl;

  server_name domain.com;

  location / {
    proxy_pass http://domain.com:6000;
    proxy_redirect http://domain.com:6000 https://domain.com:6001;
  }

  ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;
  include /etc/letsencrypt/options-ssl-nginx.conf;
}

server {
    listen droplet_public_ip:6003;
    server_name domain.com;
    return 301 https://domain.com:6001$request_uri;
    return 404;
}

Replace droplet_public_ip with droplet’s public IP address, and domain.com with your domain name. Double check the paths of ssl files.

Check the syntax running

sudo nginx -t

Restart nginx service

sudo systemctl restart nginx

Then, run

sudo netstat -tulpn | grep -e 6000 -e 6001 -e 6003

Three lines should be displayed then, similar to the below ones

Output
tcp  0  0  1.2.3.4:6000   0.0.0.0:*  LISTEN  39360/app         
tcp  0  0  1.2.3.4:6001   0.0.0.0:*  LISTEN  39591/nginx
tcp  0  0  1.2.3.4:6000   0.0.0.0:*  LISTEN  39591/nginx

1.2.3.4 represents droplet’s public IP address

2. Set up a firewall rule

Open port TCP 6003 in your firewall’s settings in the same way you have done it for port TCP 6001. Then, add a port redirecting rule.
If you use nftables, modify your ruleset file adding a chain and a rule (or just a rule, if you have appropriate chain already entered).
A chain and a rule would look like

# port redirection: TCP 6000 -> TCP 6003
chain chain_name {
  type nat hook prerouting priority -100
  tcp dport 6000 redirect to 6003
}

Replace chain_name with the appropriate one.
You can find more information on port redirection with nftables in this doc:
https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT)

If you use iptables, run the following command

sudo iptables -t nat -A PREROUTING -p tcp --dport 6000 -j REDIRECT --to-port 6003

then save the rules into your ruleset file putting appropriate file name

sudo iptables-save > your_ruleset_file

Let me know how it works, please.