Redirect from non-www to www doesn't work when SSLV2 is disabled

Problem with SSL and non-SSL .htaccess redirects

[pranaysharmadelhi]

Hi,
I was using htaccess to redirect my domain from
http://example.com to http://www.example.com
and
[example.com...] to [example.com...]
using the following code in htaccess:

Options +FollowSymLinks
RewriteEngine On
#
RewriteCond %{REQUEST_METHOD} !^(GET¦POST¦HEAD)$
RewriteRule .* - [F]
#
# http://example.com - http://www.example.com
RewriteCond %{HTTPS} =off
REwriteCond %{HTTP_HOST} =example.com
RewriteRule ^(.*) http://www.example.com/$1 [R=301,L]
#
# https://example.com - https://www.example.com
RewriteCond %{HTTPS} =on
REwriteCond %{HTTP_HOST} =example.com
RewriteRule ^(.*) https://www.example.com/$1 [R=301,L]

It was working like a charm.
But then due to some Complaince, I had to turn off SSLv2 in httpd.conf
and added following lines to the httpd.conf

SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

But now my htaccess redirect for
[example.com...] to [example.com...]
is not working.
For some reason,
RewriteCond %{HTTPS} =on
does not work in any case.

Hence,
http://example.com redirects properly to http://www.example.com
but
[example.com...] does not redirects to [example.com...]

Please reply back with any changes I need to do to my htaccess code to get it working again.
It is very important for me as the SSL certificate is a UCC and covers only www and not non-www.

Thanks

[edited by: jdMorgan at 4:04 pm (utc) on July 5, 2009]
[edit reason] example.com, formatting [/edit]

[jdMorgan]

You can try replacing these two rules:

# http://example.com - http://www.example.com
RewriteCond %{HTTPS} =off
REwriteCond %{HTTP_HOST} =example.com
RewriteRule ^(.*) http://www.example.com/$1 [R=301,L]
#
# https://example.com - https://www.example.com
RewriteCond %{HTTPS} =on
REwriteCond %{HTTP_HOST} =example.com
RewriteRule ^(.*) https://www.example.com/$1 [R=301,L][code]

with this one rule:

# Externally redirect example.com to www.example.com, preserving HTTP/HTTPS protocol
RewriteCond %{HTTP_HOST} ^example\.com
RewriteCond %{SERVER_PORT}>s ^(443>(s)¦[0-9]+>s)$
RewriteRule ^(.*)$ http%2://www.example.com/$1 [R=301,L]

Changes:

1. Uses server environment variable %{SERVER_PORT} instead of SSL module-specific variable %{HTTPS}
   
2. One rule instead of two.
   
3. FQDN and appended ports in requested hostname (e.g. example.com.:80) won't cause the code to fail.
   

Important: Replace the broken pipe "¦" character with a solid pipe character before use; POsting on this forum modifies the pipe characters.

Flush your browser cache before testing any new code uploaded to your server.

If you don't use any subdomains other than "www" and you have no plans to do so, then consider replacing the hostname test RewriteCond with:

RewriteCond %{HTTP_HOST} !^(www\.example\.com)?$ 

to redirect if the requested hostname is not *exactly* "www.example.com" and not blank (as it may be with HTTP/1.0 requests).

Jim

[pranaysharmadelhi]

The security certificate is only valid for www.example.com, so when I try to access [example.com...] in Firefox, I get the 'ssl_error_bad_cert_domain' error page. Ideally, the site should be redirected to [example.com...] before that error occurs.

I saw you helped someone with the opposite problem with:
With a (slightly-optimized and more-robust) rule such as:

RewriteCond %{HTTP_HOST} ^(www\.)?domainA\.com
RewriteRule ^(.*)$ [domainB.com...] [R=301,L]
Redirecting domainA to domainB

Can you help me reverse that rule?

If anything helps, here is the website:

and here is the current htaccess:

Options +FollowSymLinks
RewriteEngine On
RewriteBase /

Options -Indexes

RewriteCond %{REQUEST_METHOD} (TRACE¦TRACK)
RewriteRule .* - [F,L]

RewriteCond %{REQUEST_METHOD} !^(GET¦POST¦HEAD)$
RewriteRule .* - [F]

# Externally redirect example.com to example.com,preserving HTTP/HTTPS protocol

RewriteCond %{HTTP_HOST} ^example\.com
RewriteCond %{SERVER_PORT}>s ^(443>(s)¦[0-9]+>s)$
RewriteRule ^(.*)$ http%2://www.example.com/$1 [R=301,L]

It works perfectly for http but when it comes to https, I get the error
'ssl_error_bad_cert_domain'

[jdMorgan]

You will need to get a certificate for that hostname, or upgrade to a 'wild-card' certificate. The browser is reporting the error before it even connects, and as a result, server-side code is not going to be able to help.

Jim

[mx_starter]

@jdMorgan:

Dear jdMorgan,
i used your stuff:

# Externally redirect example.com to www.example.com, preserving HTTP/HTTPS protocol
RewriteCond %{HTTP_HOST} ^example\.com
RewriteCond %{SERVER_PORT}>s ^(443>(s)¦[0-9]+>s)$
RewriteRule ^(.*)$ http%2://www.example.com/$1 [R=301,L]

in order to accomplish the same redirection as the topic author ( pranaysharmadelhi)

It works nice in my case, too (when placed within an .htaccess file).
But i decided to put these configuration lines within httpd.conf instead of in .htaccess (because the Apache documentation recommends this).
For this to work, i changed the last line to:

RewriteRule ^(.*)$ http%2://www.example.com$1 [R=301,L]
(no slash between 'com' and '$1')

And the things work but only in http mode. When i request an https - no conditions are checked no rewrite is accomplished?

Any ideas why?

[jdMorgan]

Normally, there are two separate 'containers' in httpd.conf -- One for SSL and the other for non-SSL. Be sure that the code is located in both containers.

The difference between rules used in .htaccess and http.conf (or other) server config files is that in .htaccess or within a <Directory> section of a config file, the path 'seen' by a RewriteRule is localized to that directory, whereas in a config file outside of any <Directory> section, it is a full-URL path. So in the case of a client request for "example.com/<anything>" the RewriteRule pattern in .htaccess or within a config <Directory> section will *not* start with a slash, whereas within a config file but outside of a <Directory> section, it will.

So for example, in a config file:

 <Directory />
# Inside config file directory section
RewriteRule [b]^p[/b]ath$ [b]n[/b]ew-path
</Directory>
#
# Not inside a directory section
RewriteRule [b]^/a[/b]nother-path$ [b]/a[/b]nother-new-path

and in .htaccess:

 RewriteRule ^path$ new-path

For this reason, I prefer to use this form for your case:

 RewriteRule [b]^/([/b].*)$ http%2://www.example.co[b]m/$[/b]1 [R=301,L] 

but that's largely a matter of 'style' as the two are functionally equivalent.


You could also use:

 RewriteRule [b]^/?([/b].*)$ http%2://www.example.co[b]m/$[/b]1 [R=301,L] 

to make the code 'portable' between locations. But I don't like to waste CPU time, and so tend not to use that form.

Jim

[mx_starter]

Yeah, this was my initial suspicion (ssl host is not aware about the rewrite rules defined).
I'm using CentOS (but with Apache 2.2 installed from source) and here the SSL site is defined as a virtual host within a separate file which is included trough httpd.conf.

Reading trough the Apache docs i found this:
...
By default, mod_rewrite configuration settings from the main server context are not inherited by virtual hosts.
...

here: [httpd.apache.org...]

So the things started to work when i added the following 2 lines to the virtual host configuration:
RewriteEngine On
RewriteOptions Inherit

Thanks for your support - also thanks for the suggestion about places where the rewrite conditions/rules can live.