Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have installed SSL Certificate in my hosted machine. And Forced to redirect it to "https" location. It also work when it redirected to location containing .html ext. But total failed when redirecting to location containing .php ext.

In Coding my change was -

$ssl_cer = TRUE;

if ($ssl_cer && isset($_SERVER['HTTPS'])) {
   header('Strict-Transport-Security: max-age=500');
} 
elseif ($ssl_cer && !isset($_SERVER['HTTPS']) )
{
    header("HTTP/1.1 301 Moved Permanently");

    header("Location: https://" . $_SERVER["SERVER_NAME"] . $_SERVER["REQUEST_URI"]);

    exit();
 }

After doing this Change in my code; if you are trying with http then it redirected to https and also showing lock on some pages. But i am wondering that IF ssl enabled then it should get $_SERVER['HTTPS'] this server value as "On", Actulay i am not getting this value on my scripts.

Need Help soon to figure out this issue. Am i right with my description?

share|improve this question

closed as off topic by Michael Hampton, Ward, faker, TheCleaner, mdpc Feb 8 '13 at 16:56

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
If the problem is that the SSL lock is not showing, the problem is probably that the page is loading something from an insecure connection. It could be an image, a websocket, a script, or anything like that. –  David Schwartz Feb 8 '13 at 7:48
    
When you asked this question on StackOverflow you didn't include any code or indicate that it was a coding problem so they closed it and suggested you ask on ServerFault. Now on ServerFault you're asking about the value of $_SERVER['HTTPS'] inside your PHP code. Try editing one or both of your questions to match the topic of the site they are on. –  Ladadadada Feb 8 '13 at 10:09

1 Answer 1

up vote 0 down vote accepted

You have multiple problems here and by using a browser you are testing them all at once and only getting a single result at the end: fail.

Try using curl to test just one of your problems at a time. Starting with the redirect:

It's not unusual in a browser to see a redirect come back, the new request made and another redirect come back from that, yet another new request made and finally a page come back but it all happens so fast that you can't see it happen by watching the URL bar. Browsers can also cache both 302 and 301 responses which can confuse the issue even further. Use curl when testing, it's unambiguous.

curl -I http://example.com/foo.html

curl -I http://example.com/foo.php

Look to see what the HTTP response code is and the value of the Location: header. If these match what you expect, move on to the next problem.

After this, you can test the SSL of the page:

curl -I https://example.com/foo.php

The next step is probably easiest when done in a browser and that is (as @DavidSchwartz said) to check all the resources (images, stylesheets, javascripts, etc.) that the page loads. You need to check that all of the URLs start with https:// and that all of the SSL certificates of all the loaded resources are valid.

The Chrome developer tools or the Firebug addon for Firefox will be the best tools here.

If it's still eluding you, posting the actual URL here can help as bugs become easier to find when you have more people looking at them.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.