# Make http redirect to https

**URL:** <https://forum.djangoproject.com/t/make-http-redirect-to-https/12678>\
**Category:** Deployment\
**Created:** [March 18, 2022, 6:09am UTC](https://forum.djangoproject.com/t/make-http-redirect-to-https/12678 "2022-03-18T06:09:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![blaketig](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/blaketig/32/6323_2.png) [@blaketig](https://forum.djangoproject.com/u/blaketig)\
**Post date:** [March 18, 2022, 6:09am UTC](https://forum.djangoproject.com/t/make-http-redirect-to-https/12678/1 "2022-03-18T06:09:59Z")

</div>

I can’t work out if I have a problem with my nginx or django settings. I’m trying to redirect [www.example.com](http://www.example.com) to [https://example.com](https://example.com) but get the not secure browser warning. Https is working fine.

In settings.py I have:

```auto
SESSION_COOKIE_HTTPONLY = True
CSRF_COOKIE_HTTPONLY = True
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True
SECURE_BROWSER_XSS_FILTER = True
X_FRAME_OPTIONS = "DENY"
SECURE_HSTS_SECONDS = 3600 
SECURE_HSTS_PRELOAD = True
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
SECURE_SSL_REDIRECT = True

```

my nginx .conf file has:

```auto
upstream myapp_app_server {
    server unix:/webapps/myapp/myapp_env/run/gunicorn.sock fail_timeout=0;
}

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/letsencrypt/live/example.com-0001/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com-0001/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    client_max_body_size 4G;

    access_log /etc/nginx/logs/nginx-access-prod.log;
    error_log /etc/nginx/logs/nginx-error-prod.log;

    location = /favicon.ico { access_log off; log_not_found off; }

    location /static/ {
        alias /var/www/html/myapp/static/;

    }

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Host $http_host;
        proxy_redirect off;

        if (!-f $request_filename) {
            proxy_pass http://myapp_app_server;
            break;
        }

        if ( $host !~* ^(example.com|www.example.com)$ ) {
            return 444;
        }
    }
}

```

One solution I thought of is to just add a separate https certificate for [www.example.com](http://www.example.com) but it seems most other people on stack overflow or tutorials don’t have to do that. Is there anything wrong with having two ssl certificates for www and non-www?

---

<div class="post-metadata">

**Author:** ![axeljacobs](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/axeljacobs/32/3939_2.png) [@axeljacobs](https://forum.djangoproject.com/u/axeljacobs)\
**Post date:** [March 18, 2022, 9:35am UTC](https://forum.djangoproject.com/t/make-http-redirect-to-https/12678/2 "2022-03-18T09:35:24Z")

</div>

Is your let’s encrypt certificate a wildcard certificate ? \*.example.com ?

In

```auto

server {
    listen 443 ssl http2;
    server_name example.com;
    ...

```

you should also have [www.example.com](http://www.example.com)

```auto

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    ...

```

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [March 18, 2022, 11:35am UTC](https://forum.djangoproject.com/t/make-http-redirect-to-https/12678/3 "2022-03-18T11:35:33Z")

</div>

Additionally, if you click on the lock icon and dig into the information presented there, it’ll tell you _why_ it’s thinking it’s insecure.