1

My goal

Everything results in https://mydomain.tld (non-www and with TLS) and HSTS works correct. I am using the certificates from LE (Let's Encrypt) and so I used their wizard to make my website HTTPS everywhere. But it doesn't seem to work correct.

My current problems

  1. Visiting http://mydomain.tld (non-www, non-tls). The result is the Apache-status-page, but I already have a website running with content. Reloading the page results in https://mydomain.tld with website-content. But it should do that from the first vist on and not only after reloading the page.
  2. Visiting http://www.mydomain.tld results in https://www.mydomain.tld which is okay from TLS-view, but it doesn't redirect to non-www, which is my goal.
  3. Visiting https://www.mydomain.tld resuslts in https://www.mydomain.tld. No redirection to non-www.
  4. No problem: Visiting https://mydomain.tld results in the same URL, which is what I want.

DNS-settings:

A-RECORDS
.mydomain.tld -> 111.222.333.444
*.mydomain.tld -> 111.222.333.444
www.mydomain.tld -> 111.222.333.444

mydomain.tld.conf

<VirtualHost *:80>

ServerName mydomain.tld
ServerAlias www.mydomain.tld
ServerAdmin [email protected]
DocumentRoot /var/www/mydomain.tld/public_html
Redirect permanent / https://mydomain.tld/

<Directory /var/www/mydomain.tld/public_html>
Options FollowSymLinks
AllowOverride all
Require all granted
</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{SERVER_NAME}/%$1 [R,L]
</VirtualHost>

mydomain.tld-le-ssl.conf

<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerName www.mydomain.tld
        ServerAlias mydomain.tld
        ServerAdmin [email protected]
        DocumentRoot /var/www/mydomain.tld/public_html

        <Directory /var/www/mydomain.tld/public_html>
        Options FollowSymLinks
        AllowOverride all
        Require all granted
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"

RewriteEngine on
SSLCertificateFile /etc/letsencrypt/live/mydomain.tld/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.tld/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf

</VirtualHost>
</IfModule>

As you can see above in the mydomain.tld-le-ssl.conf another file is included, which might doesn't make problems, but just for the records:

options-ssl-apache.conf

# Baseline setting to Include for SSL sites

SSLEngine on

# Intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3
SSLCipherSuite          ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA$
SSLHonorCipherOrder     on
SSLCompression          off

SSLOptions +StrictRequire

# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common

#CustomLog /var/log/apache2/access.log vhost_combined
#LogLevel warn
#ErrorLog /var/log/apache2/error.log

# Always ensure Cookies have "Secure" set (JAH 2012/1)
#Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"

Bonus-problem

I have a .htaccess-file in my domain-root which makes the links look better:

  • without: https://mydomain.tld/index.php?page=news
  • with: https://mydomain.tld/news

.htaccess

RewriteEngine On

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^\w+$ index.php?page=$0 [L]
RewriteCond %{THE_REQUEST} index\.php
RewriteCond %{QUERY_STRING} ^page=(\w+)$
RewriteRule ^index\.php$ /%1? [R=301,L]

I would like to live without the .htaccess-file and add the stuff to the .conf-file(s) if possible, but everything I did, didn't work yet.

1 Answer 1

0

It's weird. Yesterday I created new certs and it still worked. Today:

  • Chrome (mobile): http://mydomain.tld redirects correct to https://mydomain.tld

  • Firefox (desktop): http://mydomain.tld doesn't redirect and results in Apache-page

  • Firefox (mobile) which never was on my website: Same as Firefox (desktop)

  • Safari (mobile) which never was on my website: Same as Firefox (desktop)

So, it seems there is still a problem. Would be great to get help to solve this finally.

Solution for this problem:

  • $ sudo a2dissite 000-default.conf
  • Remove the stuff below in mydomain.tld.conf:

RewriteEngine On RewriteCond %{HTTPS} off RewriteRule (.*) https://%{SERVER_NAME}/%$1 [R,L] RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]

Just use: Redirect permanent / https://mydomain.tld

  • $sudo /etc/init.d/apache2 restart

Final files

mydomain.tld.conf

<VirtualHost *:80>

ServerName mydomain.tld
ServerAlias www.mydomain.tld
ServerAdmin [email protected]
DocumentRoot /var/www/mydomain.tld/public_html
Redirect permanent / https://mydomain.tld

<Directory /var/www/mydomain.tld/public_html>
Options FollowSymLinks
AllowOverride all
Require all granted
</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

mydomain.tld-le-ssl.conf

LoadModule headers_module modules/mod_headers.so

<IfModule mod_ssl.c>
<VirtualHost *:443>
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomain$

ServerName mydomain.tld
ServerAlias www.mydomain.tld
ServerAdmin [email protected]
DocumentRoot /var/www/mydomain.tld/public_html

<Directory /var/www/mydomain.tld/public_html>
Options FollowSymLinks
AllowOverride all
Require all granted

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^\w+$ index.php?page=$0 [L]
RewriteCond %{THE_REQUEST} index\.php
RewriteCond %{QUERY_STRING} ^page=(\w+)$
RewriteRule ^index\.php$ /%1? [R=301,L]

</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

RewriteEngine on
SSLCertificateFile /etc/letsencrypt/live/mydomain.tld/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.tld/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf

RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]
</VirtualHost>
</IfModule>
1
  • It's good to know that you found the solution for most issues. Why not mark it as the correct answer? May 11, 2016 at 10:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .