HTTP to HTTPS redirect even for IP

apache-2.4httphttpsredirectrewrite

I have already read many question on basic http -> https redirection, but it all talks about the redirect/rewrite including only domain name.

<VirtualHost *:80>
ServerName www.example.com
Redirect / https://www.example.com/

For eg this above snippet will redirect all request to http:www.example.com to https:www.example.com
This ofcourse is the apache recommended way.

But how would we redirect http to https even if request is based on IP.
Like http:ip to https:ip How can this be achieved?
I know that https is for domain name, but I have this particular requirement of client being able to access over IP as well.

Best Answer

Requests using the ip-address (or HTTP 1.0 requests without a Host: header) and those for unknown domains are handled by the default VirtualHost which defaults to the first VirtualHost entry unless explicitly defined with:

<VirtualHost _default_:*>
    Redirect / https://www.example.com/
    ...
</VirtualHost>

So depending on your current configuration:

you may not need to do anything to handle requests using the ip-address (i.e. when you only have a single VirtualHost or the www.example.com is already the first entry)
or you can re-order the current VirtualHost entries so that www.example.com becomes the first VirtualHost entry
explicitly define the _default_:80 VirtualHost

Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

Apache, vhost, redirection, https, ssl issues

This isn't a problem with the redirect, it's a problem with the SSL (the request has to be decrypted before the redirect will take place).

Do you have Listen 443 anywhere in your Apache config? Stick it in if you don't, near the Listen 80 part. Are you running any other SSL websites on this server? Make sure they're not using the same IP address. Finally, if you do have an SSL certificate that works elsewhere, try using it for this site - it will give a warning in the browser but if you accept the warning it should redirect - then you know the problem is your SSL cert.

Best Answer

Related Solutions

NGINX Redirect – How to Rewrite All HTTP Requests to HTTPS While Maintaining Sub-Domain

Correct way in new versions of nginx

Apache, vhost, redirection, https, ssl issues

Related Topic