-3

Assuming I don't have a valid certificate to handle a https session I want to redirect all https requests to http. Is it possible without opening https session?

closed as off-topic by 87cd25770a, Dave M, squillman, Greg Askew, mdpc Nov 14 '13 at 20:36

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – 87cd25770a, Dave M, squillman, Greg Askew, mdpc
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Please elaborate further. What do you mean by "valid" certificate? – Stefan Lasiewski Nov 14 '13 at 19:41
1

Assuming I don't have a valid certificate to handle a https session I want to redirect all https requests to http. Is it possible without opening https session?

No, this is not possible, because a HTTPS session must be opened in order for the client to receive a HTTP redirect.

In order for something to redirect HTTPS to HTTP, something must be listening on the HTTPS port. Your client must first open a SSL/TLS connection to the port serving HTTPS, HTTP traffic is tunneled through the SSL/TLS connection and the server will respond with a redirect to the HTTP port. This requires that the client and server establish a HTTPS connection (that is, HTTP over SSL/TLS).

It is possible to serve SSL traffic with varying levels of "valid" certificates. I would consider a "self-signed" certificate to be "valid", but that depends on what you mean by "valid". A certificate which as been signed by a recognized Certificate Authority is recommended, but is optional for actual SSL traffic.

Your question is vague and you don't explain what you mean by "valid". Please elaborate further.

5

No, assuming by 'valid certificate' you mean you don't have any certificate.

If you mean you don't have a certificate that's signed by a trusted 3rd party and triggers a security warning on a web browser.. then you can provided everyone manually 'accepts' the connection in their browser after the warning is displayed.

If you're looking for a way to not have a certificate signed by a trusted 3rd party AND be able to send information over an SSL/HTTPS connection to redirect a client to a non-encrypted HTTP connection, no you cannot. That would defeat the purpose of SSL in the first place if you can establish a 'trusted' connection whereby data is blindly accepted from the server without a trusted signature on the certificate.

0

Make a .htaccess in the directory where the site root is and put this in it:

RewriteEngine On
RewriteCond %{HTTPS} on
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI}

and in the section of the directory (either in a virtualhost or in the main config, add AllowOverride all

Not the answer you're looking for? Browse other questions tagged or ask your own question.