0

I have a wildcard SSL certificate and I want to redirect all http requests to their equivalent https.

My server is a Debian (wheezy) and I am running Apache 2.2.22

I have added the following at the end of /etc/apache2/apache2.conf

<VirtualHost *:80>
ServerName domain.tld
ServerAlias *.domain.tld
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
</VirtualHost>

<VirtualHost *:443>
ServerName domain.tld
ServerAlias *.domain.tld
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
    SSLEngine on
    SSLCertificateFile /path/file.crt
    SSLCertificateKeyFile /path/file.key
    SSLCertificateChainFile /path/file.crt
    SSLCACertificateFile /path/file.pem
</VirtualHost>

This works well for subdomains but not the naked domain (http://www.domain.tld goes to https but http://domain.tld does not)

What is it that I am missing?

2
  • 1
    What actually happens? Jan 12, 2015 at 23:21
  • @MichaelHampton By visiting domain.tld I get redirected to domain.tld and for any other subdomain (a.domain.tld does get redirected to a.domain.tld) but by visiting domain.tld no redirects happen and I stay there. (Note: serverfault automatically strips my writing from http & https but you can see the link if you hover your mouse over)
    – user259266
    Jan 14, 2015 at 18:07

3 Answers 3

1

If it's just for one domain then you can do it in .htaccess

RewriteEngine on
RewriteCond %{HTTPS} !^on$
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

The following is also useful to secure sessions redirected from http to https

<IfModule mod_headers.c>
    Header set Strict-Transport-Security "max-age=16070400; includeSubDomains"
</IfModule>
1
  • isn't this what I already have? It only redirects when the URL entered has three parts (ie with a subdomain, abc.domain.com) but somehow does not work when you just enter domain.com
    – user259266
    Jan 14, 2015 at 22:31
1

As you have defined a catch-all rule for your virtual host, the only reason I can see, is, that the naked domain is served by some other virtual host. However you should have received appropriate warnings on apache restart, if that were the case.

Besides I wonder what Strict-Transport-Security does, when applied to the vhost on port 80. This header should apply to https only.

To check if the rewrite rules are used and what they are doing, just add the directives for Rewritelogging, for example: RewriteLogLevel 256 RewriteLog "/tmp/rewrite.log"

The log is quite verbose, so be sure to remove those lines, after having analyzed (and maybe posted) the output of the log.

2
  • Thanks @nlu the points you made were helpful. I did not receive any apache warning on restart because the source of the conflict was the server's hostname.
    – user259266
    Jan 22, 2015 at 12:10
  • and thanks for correcting me on the usage of Strict-Transport-Security and also on how to turn on Rewrite log. Helped me on some other problems I was encountering.
    – user259266
    Jan 22, 2015 at 12:13
0

I had set the hostname of my machine the same as VirtualHost, so they were both domain.tld This was what caused the VirtualHost rule not to work for the naked domain. When I changed the hostname of my machine to something neutral and restarted, the VirtualHost settings worked as expected.

You must log in to answer this question.