disable https for UNIX-domain socket path

[caiguanhao@…]

I have a local server binding to a UNIX-domain socket and a remote https server. I want to use https for the remote server. So I use "proxy_pass https:".

upstream backend {
  server unix:///tmp/socket.sock;
  server 12.34.56.78:443 backup;
}

server {
  ...
  proxy_pass https://backend;
}

But error occurred:

[error] 28416#28416: *53094 SSL_do_handshake() failed (SSL: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol) while SSL handshaking to upstream, client: xxx.xxx.xxx.xxx, server: xxx.com, request: "GET /path HTTP/1.1", upstream: "​https://unix:///tmp/socket.sock:/path", host: "xxx.com"

There is no way to define whether to use https in the upstream block. It should disable https connection for UNIX-domain socket path even if we use "proxy_pass https:".

---

Other configs:

Error "The plain HTTP request was sent to HTTPS port"

upstream backend {
  server unix:///tmp/socket.sock;
  server 12.34.56.78:443 backup;
}

server {
  ...
  proxy_pass http://backend;
}

To make it work at the moment, I use plain http:

upstream backend {
  server unix:///tmp/socket.sock;
  server 12.34.56.78 backup;
}

server {
  ...
  proxy_pass http://backend;
}

[Maxim Dounin]

The upstream block describes a number of equivalent servers - it is basically a more configurable replacement of a DNS name which resolves to multiple addresses. And the protocol is explicitly configured in the proxy_pass directive.

If you want nginx to use a different protocol when connecting to some servers, you have to configure this on the location level, by using a proxy_pass directive with the different protocol specified. In the particular case of a backup server, an ​error_page-based fallback solution might be what you need, for example:

location / {
    error_page 502 504 = @fallback;
    proxy_pass http://local;
}

location @fallback {
    proxy_pass https://remote;
}