Apache: Redirect http to https Apache secure connection – force HTTPS Connections

Let us say you have webmail sub-domain called http://mail.nixcraft.com and you would like to redirect it to https secure connection i.e. https://mail.nixcraft.com.

This will help you protect user privacy and sensitive information such as username and password remotely.

So how do you configure your Apache web server so that you prevent your web sites from being accessed without encryption?

Redirect http to https Apache Configuration

First make sure Apache is configured for HTTPS connection and necessary SSL certificates are installed.

No non-ssl access i.e. only accept https connections

Now open httpd.conf or .htaccess file (mod_rewrite not required):
# vi httpd.conf
Append following line :
Redirect permanent / https://mail.nixcraft.com/
Any request made to http://mail.nixcraft.com will goto https://mail.nixcraft.com/

Save and close the file. Restart the Apache:
# /etc/init.d/httpd restart

This is easiest way to ensure that your normal user never use plain text HTTP protocol to send data. Now this makes it much harder to sniff sensitive data.

Force webmail login over SSL https session

So if you want force users to access their webmail through https, add following configuration to .htaccess file:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Make sure you have something as follows in httpd.conf (mod_rewrite support):
LoadModule rewrite_module modules/mod_rewrite.so

Want to read Linux tips and tricks, but don't have time to check our blog everyday? Subscribe to our daily email newsletter to make sure you don't miss a single tip/tricks. Subscribe to our weekly newsletter here!

{ 34 comments… read them below or add one }

1 Naresh 02.23.07 at 5:06 pm

Hi,

We have an urls like http://mydomain.com. We need this url to secure. That is this url need to be change https://mydomain.com

Please let me know in case of any concerns.

Thanks,
Naresh

2 nixcraft 02.23.07 at 5:08 pm

Add line as follows and restart httpd:
Redirect permanent / https://mydomain.com

3 Prachi 02.27.07 at 5:01 am

hi,

we need to redirect:
http://mydoamain.com/books to
https://mydoamain.com/books

kindly suggest for the same

4 dave 04.24.07 at 1:38 am

does this work when i am using reverse proxy in apache 2? All I need to do is add in the virtual directory redirect permanent / https://1.1.1.1

5 Luis 05.03.07 at 7:15 pm

Not working for me. In Firefox I get:

“Firefox has detected that the server is redirecting the request for this address in a way that will never complete.”

I can see the location in the browser change to “https://…” but it just throws me that error.

If i write the location directly it works fine.

Thanks for any advice.

6 Danny 06.15.07 at 2:24 am

You can’t do this in a virtual server that listens on both 80 and 443. It’ll redirect 80 (http) to the 443 (https) url, but then the https site will redirect back to itself if they’re both handled in the same virtual server block.

7 vivek 06.15.07 at 10:31 am

Yes you by using RewriteCond you can use them.

8 Wolfram Jarisch 07.02.07 at 9:21 pm

I had the same experience as Luis on 5/3/2007, running on a LAN. Interestingly, when I then remove / disable the line with an `#’ like in:

# Redirect permanent / https://ws530/

redirection takes place as originally desired (in this case w/o any site certifications). In fact, I do not know how to revert back to communicate via http:// …

What happened?

9 vivek 07.02.07 at 10:45 pm

Wolfram,

I really don’t get you can you explain in details.

10 mohit 07.07.07 at 11:11 pm

hi,
i got s SSL for “secure.myurl.ext” and want the anybody accessing secure.myurl.ext sees the content from “myurl.ext” which is my main site, but i don’t want to do a redirect and URL above should remain as “secure.myurl.ext”
so do i need to re-upload everything to my secure folder, or i need to do a mod_rerite trick.

thanks,
mohit

11 sandi 07.11.07 at 1:51 pm

Hi there…

I just tried adding # to disable the line and redirection takes place pretty straight-forward

Strange… or this is a bug ?

12 Gitsnik 09.10.07 at 12:12 am

sandi… did you restart apache when you disabled the line?

In my case, running the HTTPS on the same server as the HTTP, the mod_rewrite rules:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

In my webroot/.htaccess file are enough to redirect all http traffic to https.

capcha: iptable — could also use these to do the https redirection ;)

13 Huma Hashemi 10.10.07 at 10:21 am

Hi,
I have used rewrite in my httpd.conf, but it doesn’t work.
It shows this error :
HTTP Status 405 – HTTP method GET is not supported by this URL

How can I solve this problem?

thanks

14 Rami Figo 12.13.07 at 12:09 pm

my apache listens on 80,443 ports, when i added the line
Redirect permanent / https://mail.nixcraft.com/

the redirection does not work and i could not open the site!! any ideas?!

15 Rami Figo 12.13.07 at 12:11 pm

please note i used

Redirect permanent / https://mydomain

16 Rami Figo 12.13.07 at 12:12 pm

where is used my domain in Redirect permanent / https://mydomain/

17 Liew 01.11.08 at 3:30 pm

my probelm is stil wif redirecting it to
http://wwww.abc.com/abc.php -> https://wwww.abc.com/abc.php

though the code gave the effect of redirection only the http://wwww.abc.com only…

what could i have done wrong, please advice

18 ifimbres 04.10.08 at 6:00 pm

Where exactly within the httpd.conf file do you place the line ‘Redirect permanent / https: …’

Thanks for the help.

19 SCD 05.11.08 at 1:34 pm

This way will never work. Instead go to the sites root directory. Open up .htaccess and add line

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

This should work

20 kashyap 11.24.08 at 9:22 am

if you want to remove redirect permanent, then hash the line where you have given redirect option.
then restart the server, restarting the httpd sometimes doesn’t work.

21 mark 01.02.09 at 12:41 am

“if you want to remove redirect permanent, then hash the line where you have given redirect option.
then restart the server, restarting the httpd sometimes doesn’t work.”

My redirect is still active how do i fix this also i have my server running on port 5500 but this doesnt work /foo http://localhost:5500/bar why not?

22 Cyde Weys 01.26.09 at 8:40 pm

Thanks. Your second piece of advice (using RewriteEngine) was exactly what I was looking for. We just put https on a site following concerns over passwords being transmitted in the clear and this solves that issue in one fell swoop.

23 Ben 02.12.09 at 8:15 am

I tried using this method for a server host site and everything works as it should except that the server statistics like load and uptime show as “Not Available”. These are the only two items that won’t show. Without the .htaccess file there, the server stats work fine from both http and https. I’m stumped.

24 Jeff 02.20.09 at 3:04 pm

Change your Virtual host to list on port 443 instead of port 80 and should redirect yopur site.

25 Manoj 03.05.09 at 6:27 am

I want to redirect all the http request to https. This works fine.
But I would like to access 1 directory(/images) in http.
Redirect permanent / https://www.example.com/

Any pointers?

26 Thorsten 04.05.09 at 10:43 am

I have a vhost’s subdomain running with https: https://subdomain.domain.org
All requests should redirect to the unsecure variant: http://subdomain.domain.org
I cannot use .htaccess files cause both subdomains have their own directory (it’s a plesk installation). Can I configure it with a global/ permanent redirect?
Thanks a lot

27 marc 04.28.09 at 1:57 pm

Hello guys, recently i purchased rapidssl from sslgenie. I used to redirect all my requests of http://nodewire.net/any url to https://nodewire.net/any url just by modifying .htaccess. this seemed to work well with SSLGENIE cert. However, when i switched over to Rapidssl cert, this edit in .htaccess seemed to be a problem. So i had to remove the code in htaccess, now my site has https only when a user manually types it. Please tell me how to redirect all http requests to https by editing httpd.conf or .htaccess.

PS: Rapidssl has a server root certificate while sslgenie doesnt! though this might help a bit?? (dunno)

28 hmm 05.13.09 at 9:17 pm

hi,

i’ve used

Redirect permanent / https://my.domain.com/

but then i get into loop.
I’m trying to avoid creating .htaccess file – is there any other way to fix this?

Freebsd 7.0; apache 2.2

29 mewbie 06.04.09 at 4:40 am

using: apache2-mpm-prefork 2.2.9-10+lenny2 on Linux Debian

1.) I have been trying for days to get redirect/force to only https without success.
I too get loop error if I add the line to apache2.conf:
Redirect permanent / https://my.domain.com/
============
2.) I’ve also tried both .htaccess codes posted above creating a .htaccess and put it in webroot /var/www/.htaccess (I presently don’t use any .htaccess files)
“Internal Server Error <The server encountered an internal error or misconfiguration and was unable to complete your request…..”

pico /var/www/.htaccess
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

chmod 644 /etc/apache2/.htaccess
/etc/init.d/apache2 reload

============also tried:
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://myurl.com/$1 [R,L]

same error
============
3.) Another place I read to add this line to apache2.conf:
LoadModule rewrite_module modules/mod_rewrite.so

Cannot load /etc/apache2/modules/mod_rewrite.so into server: /etc/apache2/modules/mod_rewrite.so: cannot open shared object file: No such file or directory
failed!

This prevented my apache from restarting as suspected as I can’t find in ‘any’ of the files the “LoadModule” line, period.

The only thing I could find that sounds related was this here:
/etc/apache2/mods-available/rewrite.load
so seems this module isn’t even loaded as it’s not in the /mods-enabled/ directory.

Please if anyone could help solve this that would be great!
Thank you for your time :D

30 mewbie 06.04.09 at 4:54 am

Forgot to post this part as well:

4.) Also read to do this and get error:
pico /etc/apache2/sites-available/default
Was this:

ServerAdmin webmaster@localhost

DocumentRoot /var/www/

Changed to:

ServerAdmin webmaster@localhost
RewriteEngine on
RewriteRule ^/(.*) https://myurl.com/$1

DocumentRoot /var/www/

/etc/init.d/apache2 reload
Syntax error on line 3 of /etc/apache2/sites-enabled/000-default:
Invalid command ‘RewriteEngine’, perhaps misspelled or defined by a module not included in the server

configuration
failed!

31 Matt H 06.24.09 at 4:04 pm

I was able to get a HTTP to HTTPS redirect working.

I put the redirect permanent in httpd.conf, in the section for a specific NameVirtualHost listener:

<NameVirtualHost 122.123.124.1:80>

    ServerName mywebsite.com:80
    ServerAlias http://www.mywebsite.com:80
    ServerAlias 122.123.124.1:80
    Redirect permanent / https://www.mywebsite.com/

</VirtualHost>

- Matt H
- IntuitLabs.com

32 Matt H 06.24.09 at 4:05 pm

Awww… it removed the gt/lt symbols…. {VirtualHost 122.123.124.1:80} and {/VirtualHost} surround the command below the NameVirtualHost…

33 Vivek Gite 06.24.09 at 4:50 pm

@Matt,

I’ve edited and escaped your configuration. The key is to put commands in config in pre / code tag.

HTH

34 jigish 07.03.09 at 10:21 am

hi, want to have http://secure.jigishthakar.com

and i am using shared hosting server.
can you please tell me how can i convert my site to secure
https://secure.jigishthakar.com

??

thanks

Leave a Comment

You can use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Previous post: How to remove unwanted mails from UNIX mailboxes or folders

Next post: How to upgrade chrooted lighttpd web server