I will share with you a case when installing SSL Free provided by CloudFlare and installing
Key + Cert on hosting when accessing with Chrome error "ERR_SSL_VERSION_OR_CIPHER_MISMATCH" try with Firefox "Secure connection failed and firefox did not connect" I have searched through some informative websites and found out do "You should turn on 'Always use HTTPS' as well as 'Automatic HTTPS Rewrites' on that SSL/TLS app, this will make sure all resources are loaded over HTTPS including the main page" and I am using Wordpress source code web, just adding rule in .htaccess force HTTPS solved this error and successfully accessed the website.
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
Successfully processed
Related
I am new to server and cpanel. I have successfully purchased and installed ssl certificate on my domain. Now when I try to add redirect (301) for http to HTTPS for all traffic under cpanel its giving error " The is error in Apache rule while processing your request".
Please help
Cpanel official documents says:
If you try to setup a Dedicated SSL redirect using the cPanel steps
, cPanel will fail with an error message.
Its best you write your rewrite rules directly into .htaccess file under your root directory.
See here for inmotion hosting help page
Try this in .htaccess:
RewriteEngine On RewriteCond %{SERVER_PORT} 80 RewriteRule ^(.*)$ https://www.yourdomain.com/$1 [R,L]
Have hosting account with an addon domain. Directory structure is as follows:
/public_html (main site is hosted in this directory)
/public_html/secondary_site/ (secondary site is hosted in this directory.
I am using the following .htaccess file in the public_html folder (and no .htaccess file in the secondary_site folder):
RewriteEngine On
# BEGIN Domain to folder mapping
# pointing HTTPS secondarysite.com to https://primarysite.com/secondarysite/
RewriteCond %{SERVER_PORT} ^443$
ReWriteCond %{HTTP_HOST} primarysite.com
ReWriteCond %{REQUEST_URI} !primarysite/
ReWriteRule ^(.*)$ https://primarysite.com/secondarysite/$1 [L]
# pointing HTTP secondarysite.com to http://primarysite.com/secondarysite/
RewriteCond %{SERVER_PORT} ^80$
ReWriteCond %{HTTP_HOST} secondarysite.com
ReWriteCond %{REQUEST_URI} !secondarysite/
ReWriteRule ^(.*)$ http://primarysite.com/secondarysite/$1 [L]
# END Domain to folder mapping
The second rule works fine for non-secure connections, it correctly forwards to the public_html/secondary_site directory.
However when I try to securely connect to secondarysite.com I am greeted with the warning page stating:
You attempted to reach secondarysite.com, but instead you actually
reached a server identifying itself as primarysite.com. This may be
caused by a misconfiguration on the server or by something more
serious. An attacker on your network could be trying to get you to
visit a fake (and potentially harmful) version of secondarysite.com.
If I click on the "I understand, proceed" button, it then takes me to the correct, SSL secured directory of public_html/secondary_site. The SSL lock is green and happy.
Why is this .htaccess file not catching requests for secondarysite and re-writing them to the primarysite structure before it has a chance to throw a fit about a bad certificate due to domains not matching?
(This is more or less the same problem as in this question, so I'll adapt my own answer from there.)
HTTPS is HTTP over TLS/SSL (see RFC 2818), which first establishes the SSL/TLS connection before any HTTP traffic is sent. Any redirection (via mod_rewrite, custom PHP code or other) will always apply after the SSL/TLS connection is established.
Not doing so would actually be a security issue, since an attacker could rewrite and redirect the client before the certificate has been verified.
If you want to redirect from https://secondarysite.com to https://primarysite.com, the certificate obtained for https://secondarysite.com must be valid for secondarysite.com (and then, the certificate obtained for https://primarysite.com must be valid for primarysite.com).
(You could use two different certificates with Server Name Indication if the two hosts are served on the same IP address, but not all clients would necessarily support it.)
The easiest would be to obtain a certificate that's valid for both secondarysite.com and primarysite.com. This can be done using a single certificate with multiple Subject Alternative Name entries.
My web host is hostgator.com with Apache, cPanel, etc.
A spammer somewhere has set links to my site somewhere, using https in the URL. I don't have an SSL certificate and would expect these links to resolve to the error 404 page.
However the links cause Firefox to say my domains are attack sites, due to their hookup with Google safe browsing.
Hostgator support is slow and clueless. Links are in the following format.
https://mydomainname.com/
https://mydomainname.com/digital-photography-forum-uk/
https://mydomainname.com/fastibl/
https://mydomainname.com/search-engine-marketing/
https://mydomainname.com/search-engine-optimisation/
https://mydomainname.com/website-programming-discussion/
I've edited .htaccess a dozen times, using online examples of redirecting https to http and nothing (yet) works.
Just try these configuration directives in your .htaccess file:
Options +FollowSymlinks
RewriteEngine on
RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ http://mydomainname.com/$1 [R=301,L]
But please considered the [R=301] flag with this link: https://stackoverflow.com/a/15999177/2007055
Or try to use a robots.txt file if it can block or remove the pages in HTTPS on search engines. And if any of those solutions did not work, then you've better purchase an SSL certificate to solve your problem.
I'm using the bartt-ssl_requirement gem to create an https connection on a shopping cart. The rest of the site doesn't need it.
In my application controller:
include SslRequirement
In my Orders controller:
ssl_required :new
Locally, I get an SSL Connection error:
Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error.
In production I get page not found error:
The requested URL /orders/new was not found on this server.
So far I haven't been successful doing things like adding the :protocol attribute to the routes. Am I missing something?
Also, we have an htaccess file that redirects everything to www. Would this mess the https stuff up?
RewriteEngine On
#redirects to www
RewriteCond %{HTTP_HOST} ^myapplication.com$ [NC]
RewriteRule ^(.*)$ http://www.myapplication.com/$1 [R=301,L]
To be specific, I'm mostly concerned with the production error.
Thanks
Ok, apparently this was an Apache configuration issue with port 443. Wasn't set up for capistrano.
I need to automatically redirect any https:// to http:// on my localhost environment.
I tried to use a .htaccess file which I placed on my htdocs/ with the following code:
RewriteEngine On
RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
For some reason this is not working. Any advice?
The problem with the rewrite rule is that it will never be reached if apache is not configured properly for SSL. The browser is trying to connect to http://localhost:443 and unless apache or some other service is configured on that port you'll get a timeout.
The best solution would be to create a self-signed certificate for apache running on localhost and create a rule in your web browser to trust the certificate:
Create a self-signed certificate for apache:
http://www.perturb.org/display/entry/754/