Even though I've used Apache for years, I'm new to https and SSL with Apache. For testing, I have executed some openssl commands as found on the Internet to generate a self-signed cert for use with Apache. When I hit an https://mydomain URL for the first time, I got the browser warning about the cert, which was expected. After accepting the cert in my browser(s), it seems that all https URLs are redirecting to the http equivalents with a 301.

I can't determine why. Any clues? I have one .htaccess file in the root of the public dir, but I don't think it is the cause (there is no mention of https).

This is Gentoo Linux, Apache 2.2.11.

Here is a portion of my Apache config. Most of it is just what came with Gentoo's Apache installation by default.

<IfDefine SSL>
<IfModule ssl_module>
    Listen 443
    NameVirtualHost *:443

    <VirtualHost *:443>
        ServerName mydomain.com
        Include /etc/apache2/vhosts.d/default_vhost.include
        ErrorLog /var/log/apache2/mydomain.com.ssl.errors
        CustomLog /var/log/apache2/mydomain.com.ssl.log combined

        <IfModule log_config_module>
        TransferLog /var/log/apache2/ssl_access_log

        SSLEngine on


        SSLCertificateFile /etc/apache2/ssl/mydomain.com.crt
        SSLCertificateKeyFile /etc/apache2/ssl/mydomain.com.key
        SSLOptions StrictRequire

        <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars

        <Directory "/var/www/localhost/cgi-bin">
        SSLOptions +StdEnvVars

        SSLProtocol all -SSLv2

        <IfModule setenvif_module>
        BrowserMatch ".*MSIE.*" \
            nokeepalive ssl-unclean-shutdown \
            downgrade-1.0 force-response-1.0

        <IfModule log_config_module>
        CustomLog /var/log/apache2/ssl_request_log \
            "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

        RewriteEngine On

        DocumentRoot "/var/www/mydomain.com/public"
        <Directory "/var/www/mydomain.com/public">
            Options Indexes FollowSymLinks ExecCGI
            AllowOverride All
            Order allow,deny
            Allow from all


  • Alright, I've established that a plain HTML file, as well as a <? phpinfo ?> page remain as https. So I suppose the problem is with the PHP code. – Pistos Jul 21 '09 at 0:55

Do you have a CMS or blog software such as WordPress installed on this site? Many such systems use 301 redirects to direct you to the preferred hostname (with www) or rewrite URLs for SEO / permalink purposes.

If you are running a CMS, disable permalinks / SEO optimization and if you're still having problems, update your question with the contents of the .htaccess and let us know what is running on the site (or if it's plain HTML, etc.)

Edit: Now that you've determined that the redirects are only happening within the PHP site and not any generic PHP or HTML files you can search the PHP code for where it's doing this. Search for "header(" and you'll probably find it.

  • On this particular domain, no CMS or blog software, but it's some fairly involved PHP, most of which I didn't write myself. Let me get back to you on the htaccess. – Pistos Jul 21 '09 at 0:49
  • Okay, I totally moved the .htaccess out of the way (.bak) and it had no impact, things are still 301ing to http. Let me try some basic plain HTML pages instead of the PHP, though. – Pistos Jul 21 '09 at 0:51
  • I didn't look for that when debugging, but FWIW, the relevant code would indeed have turned up in a grep for 'header\('. – Pistos Jul 21 '09 at 1:17

I found a relevant portion of the code, and made some adjustments. My problem is now solved; it was not a server configuration issue at all, just some awry PHP code. @Dave Forgac: Thanks for taking the time to respond. Your suggestions got my mind thinking in the right directions about the right things, and troubleshooting went smoothly after that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.