0

My SSL certificate expired recently and I have been trying to disable SSL temporarily until I can get it renewed however something keeps redirecting the subdomain www. to HTTPS://

It's not the .htaccess file and httpd.conf is set up with a VirtualHost for unsecured connections:

<VirtualHost *:80>
     ServerAdmin example@example.com
     DocumentRoot /var/www/example.com/public_html
     ServerName www.example.com
     ServerAlias example.com
     ErrorLog /var/www/example.com/error.log
     CustomLog /var/www/example.com/access.log common
     <Directory "/var/www/example.com">
          AllowOverride All
     </Directory>
 </VirtualHost>

example.com works fine, but if I visit www.example.com it's redirected to HTTPS://

What else could it be?

  • 1
    Did you try with a different browser ? It could be HTTP Strict Transport Security – eltrai Jun 1 '15 at 14:36
  • @eltrai You're right, it works in IE, thank you I'll read up on this. – Alan Richards Jun 1 '15 at 14:38
  • Unfortunatly, if that's the case, there is not much you can do, as it was designed to prevent the very thing you are trying to do. – eltrai Jun 1 '15 at 14:40
  • @eltrai I don't even have Strict-Transport-Security specified anywhere in Apache nor have I ever enrolled in HSTS. Sigh, this is ridiculous. – Alan Richards Jun 1 '15 at 14:45
  • I've added an answer including how to check for HSTS. It's an header so it can be added by the php script or something, and it's not easy to find out in the config. – eltrai Jun 1 '15 at 14:49
3

If your website used HTTP Strict-Transport-Security (RFC6797) in the past, it explains that regardless of the current config of the webserver, any client, which previously connected to the website, continues to try to connect to your website using HTTPS.

You can check if that's the case using your browser's inspector (in Firefox, CTRL+Shift+I, then Network, F5, click on the request and then on tab security). Unfortunatly, there is not much you can do, as Strict-Transport-Security will prevent any attempt to visit your website without TLS for a long time (usually a few months).

Therefore I would advise to replace the certificate as soon as possible, as this mitigation cannot be effective for any previous visitor of the website.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.