2

I have a domain at staging.example.com which I want to run without HTTPS for testing purposes. The main domain (example.com) does use SSL.

I am trying to find a rewrite rule that will forward to HTTPS for the main domain, but not subdomains (with the exception of www.).

Currently, I have tested by removing all the rewrite rules that I can find from my virtual host files, and visiting both the domain and subdomain. Despite running a2ensite again for both virtualhost files and running a sudo service apache2 reload and sudo service apache2 restart, the browser is still being redirected to HTTPS on the subdomain and main domain.

Is there anywhere else that this redirect may be taking place? Here are my virtualhosts:

<VirtualHost *:80>
        ServerAdmin asdfasdf@asdfasdf.com
        ServerName example.com
        ServerAlias www.example.com
        DocumentRoot /srv/www/example.com/public_html/example/example-production/current/public

        Options Indexes FollowSymLinks Includes ExecCGI
        <Directory /srv/www/example.com/public_html/example/example-production/current/public>
                Allow from all
                Options -MultiViews -Indexes
        </Directory>

        ErrorLog /srv/www/example.com/public_html/example/example-production/current/log/error.log
        CustomLog /srv/www/example.com/public_html/example/example-production/current/log/access.log combined
        <Location />


    </Location>
</VirtualHost>

<VirtualHost *:443>
        ServerName example.com
        ServerAlias www.example.com
        DocumentRoot /srv/www/example.com/public_html/example/example-production/current/public
        ErrorLog /srv/www/example.com/public_html/example/example-production/current/log/error.log

        SSLEngine On
        SSLCertificateFile /etc/apache2/ssl/certs/example.com.crt
        SSLCertificateKeyFile /etc/apache2/ssl/certs/example.com.key
        SSLCACertificateFile /etc/apache2/ssl/certs/example.com.intermediate.crt
        SSLOptions +StrictRequire
Header set Strict-Transport-Security "max-age=16070400; includeSubDomains"
        CustomLog /var/log/apache2/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"


</VirtualHost>

And the staging subdomain:

<VirtualHost *:80>

        ServerName staging.example.com
        DocumentRoot /srv/www/example.com/public_html/example/example-staging/current/public
        <Directory /srv/www/example.com/public_html/example/example-staging/current/public>
                Allow from all
                Options -Multiviews
        </Directory>

</VirtualHost>
2
  • Are you sure your browser hasn't cached the redirection (after all, it is sent as a permanent redirect, 301, by default)? You could also try grepping for Redirect or https in /etc/apache2 to ensure that no module or other virtual host is causing the redirection. – n.st Jul 6 '14 at 10:46
  • Did you clear your browser cache? And is your application doing the redirect? – Michael Hampton Jul 6 '14 at 12:47
1
Header set Strict-Transport-Security "max-age=16070400; includeSubDomains"

Your browser is honoring it, including the includeSubDomains

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.