Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I used to operate a website with an SSL certificate, but have stopped using the SSL certificate. The problem is that most of the external links to the website use the https:// prefix.

I have tried the https:// to http:// redirect in the .htaccess file:

RewriteEngine On

RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI}

But it seems, as has been pointed out elsewhere, that the server is trying to retrieve the certificate before activating the redirect. Hence, an error is shown before the redirect is ever accomplished. The error is either a warning that the certificate is expired, or if I delete the certificate signing request, then an error that SSL received a record that exceeded the maximum permissible length.

Is there any way to allow the incoming links to be redirected properly?

share|improve this question

migrated from stackoverflow.com Sep 17 '12 at 23:12

This question came from our site for professional and enthusiast programmers.

1  
SSL is negotiated before any HTTP requests take place, as I think you have found out. I think you're going to have a problem getting this to work like you want, but I'm voting to migrate to ServerFault.com in case someone there has a better answer. –  Michael Sep 16 '12 at 20:34
    
It does seem that this may be difficult achieve. It is a real bummer to lose the links built up around the internet, and worse, for visitors to think the site has been compromised or disappeared. –  user981178 Sep 16 '12 at 20:40
add comment

3 Answers 3

up vote 3 down vote accepted

The difference between http and https is that https requests are sent over an ssl-encrypted connection. The ssl-encrypted connection must be established between the browser and the server before the browser sends the http request.

Https requests are in fact http requests that are sent over an ssl encrypted connection. If the server rejects to establish an ssl encrypted connection then the browser will have no connection to send the request over. The browser and the server will have no way of talking to each other. The browser will not be able to send the url that it wants to access and the server will not be able to respond with a redirect to another url.

So this is not possible. If you want to respond to https links, then you need an ssl certificate.

share|improve this answer
add comment

No, if it were possible to redirect from https to http without a real certificate, it would be a major security flaw.

Consider a criminal somehow being able to make the bank secure server redirect to an insecure connection without needing a real https certificate for the site, it would allow the criminal to hijack the connection without the user knowing about it.

The only solution I can see is to get a cheap certificate and then do a normal redirect from the HTTPS site (which the user can't reach without a valid certificate) to the regular site for those external links.

share|improve this answer
    
Right, it is better this way. Too bad there is not some way to setup an approved override as the site owner. –  user981178 Sep 16 '12 at 20:47
add comment

You should create in your .htaccess

ErrorDocument 500 http://anotherserer.com/errorPage.php
share|improve this answer
    
Thanks for the suggestion. Even with this in the .htaccess, it is not using the page I enter for the 500 error for this particular error. It seems that, perhaps, nothing in the .htaccess is being activated because of the initial error. –  user981178 Sep 16 '12 at 20:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.