mod_rewrite rule htaccess not working as expected - .htaccess

i want https://www.kita-neukoelln.tandembtl.de/ go to https://kita-neukoelln.tandembtl.de/
it is only working with chrome and IE11, is there a way for other browser?
they check ssl for www.subdomain.domain.de before redirect :(
Thanks
RewriteCond %{HTTP_HOST} ^www\.kita-neukoelln.tandembtl\.de$ [NC]
RewriteRule (.*) https://kita-neukoelln.tandembtl.de/$1 [R=301,L]

Actually, I get a certificate error in every browser I've tried.
The problem, www.kita-neukoelln.tandembtl.de is a sub-subdomain and the security certificate for *.tandembtl.de does not cover it:
A wildcard SSL certificate for *.example.net will match
sub.example.net but not sub.sub.example.net.

Related

HT Access issue

I have a problem with our site after reinstalling the SSL certificate, where the www version of the site (www.mountainx.com) pulls up a completely different site. if you enter the non-www version (mountainx.com), it goes to the correct website. Some of the rules in my .HTAccess file are here - Any help would be appreciated or at least I would like to get a discussion going -
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
RewriteCond %{HTTP_HOST} ^www\.example\.com [NC]
RewriteRule ^(.*)$ http://example.com/$1 [L,R=301]
Also I have a certain number of proxy redirects that are not working either after the SSL change and I had to redirect them to the original hosts. To clarify, we use a third party to host our calendar but want to obscure the URL so it looks like we are still hosting the files. When the SSL certificate was installed, it suddenly started throwing up a 503 error so we agreed to change to the original URL hosted remotely. Also any good tutorials on .htaccess file out there? They seem to be pretty few and far between.

How to redirect all HTTPs requests to HTTP

I know that people usually ask how to redirect to https, but i have an opposite issue. I check my stats and for a reason that i don't know i get some visits to https:// page, which i don't have.
So my question is how can i redirect all my https requests to http ?
I'm on VPS
Linux version 2.6.32-042stab116.1 , CentOS release 6.7 (Final)
I tried some codes that i find here, but they unfortunately don't work
F.e. this
RewriteEngine On
RewriteCond %{HTTPS} on
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI}
Unfortunately that's not really possible. The SSL handshake occurs before any redirects happen, so no redirect will get around that issue. Really your only option is to look into getting a cheap certificate.
Actually, you can force HTTP, you also almost had it correct. Use this in your .htaccess:
RewriteEngine On
RewriteCond %{HTTPS} on
RewriteRule ^ http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

How to redirect https://www.example.com to https://example.com

I have looked around and I can't seem to find a definitive solution for this. We are having a small problem with a few or our visitors that are typing in our domain as such:
https://www.example.com - This is giving a security warning "There is a problem with this website's security certificate."
We have an SSL set up for example.com
So if someone types in http://www.example.com or www.example.com this gets redirected to https://example.com which works fine.
This is what I have currently have in my .htaccess file:
Options +FollowSymLinks
RewriteEngine on
RewriteCond %{SERVER_PORT} 80
RewriteCond %{SERVER_PORT} !^443$ [OR]
RewriteCond %{HTTPS} on
RewriteCond %{HTTP_HOST} ^www\.(.*) [NC]
RewriteRule ^(.*)$ https://%1/$1 [R=301,NC,L]
edit:
Most SSL certificates are issued for a specific hostname, e.g. www.example.com or just example.com (and there can be wildcard certificates for *.example.com too) so this might be the case.
Maybe making the www. subdomain an optional match in the last RewriteCond might help to get the user to the domain stated in the certificate:
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.*) [NC]
I think the problem is not with the rewrite/redirect rules but simply with the way http servers handle ssl connection. Before even server has a chance to look into rewrite/redirect rules the SSL handshake take place and if we have a cert for example.com and we enter URL www.example.com connection will abort due to invalid certificate. Check for yourself, set up redirect condition to point URL www.example.com to example.com on SSL secured domain. At first you'll get invalid cert error, but when you add an exception to your browser you'll notice that it works.
Try this
RewriteCond %{HTTP_HOST} ^[a-z0-9-]+\.[a-z]+$
RewriteRule !"" https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L,NC]
instead of
RewriteCond %{HTTP_HOST} ^www\.(.*) [NC]
RewriteRule ^(.*)$ https://%1/$1 [R=301,NC,L]
What you are trying to do is impossible. If a user accesses www.domain.cc over SSL, then you will get a certificate error if you do not have a valid SSL certificate - even if all you want to do is redirect them to the correct site.
You will either need a new certificate for www.domain.cc, or convince your registrar to give you a wildcard certificate for *.domain.cc, or one with multiple subjectAltName properties. See http://www.crsr.net/Notes/Apache-HTTPS-virtual-host.html
Or ask for SNA http://en.wikipedia.org/wiki/Server_Name_Indication
Firstly, you will need an SSL certificate that covers both www.xxxx.yyy and xxxx.yyy.
Your provider may cover both if you get the cert for www.xxxx.yyy, but only the xxxx.yyy if you get it for that. Read their conditions carefully.
I had read so many suggestions as to how to redirect, with all manner of ad-hoc opinions, with varying results, and mostly without any formal explanation.
Of course, that means going to the Apache .htaccess reference and working from first principles was in order.
Just to reiterate, the main requirement is to redirect all http(s) requests to https://xxxx.yyy.
As always, turn the rewrite engine on:
RewriteEngine On
For http, that is:
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://xxx.yyy/$1 [L,R]
However, doing the same for https (port = 443), will force a loop, which bombs out with an error. We have to restrict the process to only working for the https and www. We do this by providing two RewriteCond statements in a row, which are treated as an implicit AND:
RewriteCond %{SERVER_PORT} 443
RewriteCond %{HTTP_HOST} ^www[.].+$
RewriteRule ^(.*)$ https://xxxx.yyy/$1 [L,R]
At the end of the RewriteRule, the [L,R] tells the rewrite engine to:
L = stop at that rule. That is, if a rule is executed because its conditions (RewriteCond) were satisfied, stop when done, else go to the next conditions/rule set.
R = issue a HTTP redirect (default code = 302) to the browser, so user or automatic action can be taken to update bookmarks, so they always use the https://xxxx.yyy in future.

Why do my forms break when using an .htaccess redirect?

During development, I used subdomain.domain.com and everything worked.
Moving to live, the files are under www, but I wanted to use domain.com, and that's making certain functionalities not work as follows.
I got a dedicated SSL certificate for domain.com, so I have this in my htaccess, and my SSL works fine:
# Redirect www.domain.com to domain.com
RewriteCond %{HTTP_HOST} ^www.domain.com [NC]
RewriteRule ^(.*)$ http://domain.com/$1 [L,R=301]
However for some reason that breaks some other functionality where a form gets reposted and I can't figure out why. But if I change htaccess to this:
# Redirect domain.com to www.domain.com
RewriteCond %{HTTP_HOST} ^domain.com [NC]
RewriteRule ^(.*)$ http://www.domain.com/$1 [L,R=301]
then the broken functionality works, but the SSL doesn't.
Before I go invest in an SSL for www.domain.com, I wanted to check with the experts here to see if there is something simple I can do to my htaccess file to make both scenarios work.
Many thanks in advance!
A visible 301 redirect is losing its POST data. From RFC 2616:
If the 301 status code is received in
response to a request other than GET
or HEAD, the user agent MUST NOT
automatically redirect the request
unless it can be confirmed by the
user, since this might change the
conditions under which the request was
issued.
So, you have to fix the forms, not the .htaccess.

https to http redirection when ssl is not installed

We have a site which was https enabled. After a site revamp we have removed the certificate and https://www.foo.com is not http://www.foo.com.
There are many links in other sites, which link to th old https site, which we have no control. Is there something we can do in out side to redirect these links to home page atleast?
Will url rewriting work in this case?
There were some broken link which we fixed with a custom 404 page and tracking the links.
Does this belong to serverfault?
You're pretty much out of luck - you can do URL rewriting as #Josh says, but before the browser even gets that far, most of them will give the user a big warning message telling them the SSL certificate isn't valid, which will put off most of the visitors.
I'd recommend buying an SSL certificate - they're not so expensive - then doing the rewrite.
using mod_rewrite
# forces everything to non-secure if secure (http)
RewriteCond %{SERVER_PORT} =443
RewriteRule ^(.*)$ http://%{SERVER_NAME}/$1 [R,L]
Josh
The solution for IIS may be ISAPI_Rewrite 3. Here's the .htaccess:
RewriteBase /
RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ http://%{HTTP_HOST}/$1 [R=301,L]

Resources