Iptable : Redirect https to http except for specific host

Question

I have multiple websites on my server, and just one of them is through https (say : https://admin.example.com).

But if an user tries to access to https://www.example.com, he got a warning about an invalid SSL certificate, dedicated to admin.example.com and wrong for www.example.com (obviously!).

I'd like to redirect every https request that is not for admin.example.com to the original host, but in http, is this possible?

To be clear :

• https://admin.example.com : no redirect
• http://admin.example.com : redirect to https://admin.example.com (done via NGinx configuration)
• https://whatever.example.com : redirect to http://whatever.example.com
• https://whatever.example.com/query/string?complex=1 : redirect to http://whatever.example.com/query/string?complex=1

Is this possible via iptables? if so, how?

Thank you for your help, I appreciate :)

Answer 1

Alternatives to solve the warning problem would be one of the following

• Close the https port all together (port 443)
• Buy a SSL-certificate that is valid for all domains
• Put the https-site on a seperate IP-address, and only open port 443 on that IP.

If you absolutely want to use a redirect, you would have to send the redirect to the browser after the SSL-certificate have been presented to the browser, and then also after the warning have shown. There is probably some way you could redirect port 443 to port 80 with iptables, but I do not know of any method that would do that in a "good" method, as a browser requesting a site over https assumes it meets a SSL-enabled site.

Answer 2

You could not redirect https traffic to http. This redirect must be seen by the browser, to know, that there will be non-SSL Traffic.

You should either buy a valid SSL Certificate with is widely trusted, or close the https port.

You could redirect via some configuration parameters for Apache, but you will still get the warning first.