Apache, vhost, redirection, https, ssl issues

Question

Issues:

• https://www.example.com -> should redirect to http://www.example.com, doesn't, gives Error code: ssl_error_rx_record_too_long without redirection, error_log: "[error] [client 127.0.1.3] Invalid method in request \x16\x03\x01
• https://www.example.com/fundprocess.html -> should redirect https://example.com/fundprocess.html, gives Error code: ssl_error_rx_record_too_long without redirection, error_log: "[error] [client 127.0.1.3] Invalid method in request \x16\x03\x01"
• https://example.com -> Should Redirect to http://www.example.com, doesn't
• http://example.com/ -> Should redirect to http://www.example.com, doesn't
• http://example.com/fundprocess.html should redirect to https://example.com/fundprocess.html, doesn't

No entries in rewrite log against these errors.

vhost Configuration

<VirtualHost 127.0.1.3:80>
ServerAdmin webmaster@example.com
ServerName www.example.com

DocumentRoot /var/www/html
<Directory /var/www/html>
    Options Indexes FollowSymLinks
    AllowOverride All


    Order allow,deny
    Allow from all
</Directory>


Redirect permanent /fundprocess.html https://example.com/fundprocess.html
Redirect permanent /fund_process.php https://example.com/fund_process.php

ErrorLog /var/log/apache2/example.com-error_log
TransferLog /var/log/apache2/example.com-access_log
LogLevel warn

RewriteLog /var/log/apache2/example.com-rewrite_log
RewriteLogLevel 9



</VirtualHost>


<VirtualHost 127.0.1.2:80>
ServerAdmin webmaster@example.com
ServerName example.com
DocumentRoot /var/www/html

    RewriteCond %{REQUEST_URI} !fundprocess.html [NC]
    RewriteCond %{REQUEST_URI} !fund_process.php [NC]
    RewriteRule (.*) http://www.example.com/$1 [R=301,L]

    RewriteCond %{REQUEST_URI} fundprocess.html [NC]
    RewriteCond %{REQUEST_URI} fund_process.php [NC]
    RewriteRule (.*) https://example.com/$1 [R=301,L]



</VirtualHost>



<VirtualHost 127.0.1.3:443>
ServerAdmin webmaster@example.com
ServerName www.example.com
DocumentRoot /var/www/html

    RewriteCond %{REQUEST_URI} !fundprocess.html [NC]
    RewriteCond %{REQUEST_URI} !fund_process.php [NC]
    RewriteRule (.*) http://www.example.com/$1 [R=301,L]

    RewriteCond %{REQUEST_URI} fundprocess.html [NC]
    RewriteCond %{REQUEST_URI} fund_process.php [NC]
    RewriteRule (.*) https://example.com/$1 [R=301,L]


</VirtualHost>



<VirtualHost 127.0.1.2:443>
ServerAdmin webmaster@example.com
ServerName example.com


DocumentRoot /var/www/html
<Directory /var/www/html>

    Options Indexes FollowSymLinks
    AllowOverride All


    Order allow,deny
    Allow from all

 </Directory>


RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !fundprocess.html [NC]
RewriteCond %{REQUEST_URI} !fund_process.php [NC]
RewriteRule (.*) http://www.example.com/$1 [R=301,L]

ErrorLog /var/log/apache2/example.com-ssl-error_log
TransferLog /var/log/apache2/example.com-ssl-access_log
LogLevel warn

RewriteLog /var/log/apache2/example.com-rewrite_log
RewriteLogLevel 9


SSLEngine On
SSLCertificateFile /etc/certs/example.crt
SSLCertificateKeyFile /etc/certs/example.key


SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

</VirtualHost>

Answer 1

This isn't a problem with the redirect, it's a problem with the SSL (the request has to be decrypted before the redirect will take place).

Do you have Listen 443 anywhere in your Apache config? Stick it in if you don't, near the Listen 80 part. Are you running any other SSL websites on this server? Make sure they're not using the same IP address. Finally, if you do have an SSL certificate that works elsewhere, try using it for this site - it will give a warning in the browser but if you accept the warning it should redirect - then you know the problem is your SSL cert.

Answer 2

ssl_error_rx_record_too_long happens when apache is expecting ssl and receives http.

Make sure all port 443 requests get to a virtual host with SSLEngine On. You need to fix your <VirtualHost 127.0.1.3:443>.

Also, your certificate needs to work for both example.com and *.example.com. Otherwise your clients will get ugly warnings instead of a redirect.