I have a wildcard SSL certificate and I want to redirect all http requests to their equivalent https.

My server is a Debian (wheezy) and I am running Apache 2.2.22

I have added the following at the end of /etc/apache2/apache2.conf

<VirtualHost *:80>
ServerName domain.tld
ServerAlias *.domain.tld
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

<VirtualHost *:443>
ServerName domain.tld
ServerAlias *.domain.tld
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
    SSLEngine on
    SSLCertificateFile /path/file.crt
    SSLCertificateKeyFile /path/file.key
    SSLCertificateChainFile /path/file.crt
    SSLCACertificateFile /path/file.pem

This works well for subdomains but not the naked domain (http://www.domain.tld goes to https but http://domain.tld does not)

What is it that I am missing?

  • 1
    What actually happens? – Michael Hampton Jan 12 '15 at 23:21
  • @MichaelHampton By visiting domain.tld I get redirected to domain.tld and for any other subdomain (a.domain.tld does get redirected to a.domain.tld) but by visiting domain.tld no redirects happen and I stay there. (Note: serverfault automatically strips my writing from http & https but you can see the link if you hover your mouse over) – user259266 Jan 14 '15 at 18:07

If it's just for one domain then you can do it in .htaccess

RewriteEngine on
RewriteCond %{HTTPS} !^on$
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

The following is also useful to secure sessions redirected from http to https

<IfModule mod_headers.c>
    Header set Strict-Transport-Security "max-age=16070400; includeSubDomains"
  • isn't this what I already have? It only redirects when the URL entered has three parts (ie with a subdomain, abc.domain.com) but somehow does not work when you just enter domain.com – user259266 Jan 14 '15 at 22:31

As you have defined a catch-all rule for your virtual host, the only reason I can see, is, that the naked domain is served by some other virtual host. However you should have received appropriate warnings on apache restart, if that were the case.

Besides I wonder what Strict-Transport-Security does, when applied to the vhost on port 80. This header should apply to https only.

To check if the rewrite rules are used and what they are doing, just add the directives for Rewritelogging, for example: RewriteLogLevel 256 RewriteLog "/tmp/rewrite.log"

The log is quite verbose, so be sure to remove those lines, after having analyzed (and maybe posted) the output of the log.

  • Thanks @nlu the points you made were helpful. I did not receive any apache warning on restart because the source of the conflict was the server's hostname. – user259266 Jan 22 '15 at 12:10
  • and thanks for correcting me on the usage of Strict-Transport-Security and also on how to turn on Rewrite log. Helped me on some other problems I was encountering. – user259266 Jan 22 '15 at 12:13

I had set the hostname of my machine the same as VirtualHost, so they were both domain.tld This was what caused the VirtualHost rule not to work for the naked domain. When I changed the hostname of my machine to something neutral and restarted, the VirtualHost settings worked as expected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy