Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to respond to an SSL Handshake request by sending back a http 302 redirect without making the browser mad?

I would like to immediately redirect to a different site upon receiving the https request. Will the browser allow that?

share|improve this question
up vote 5 down vote accepted

If I understand you correctly, you want to send a 302 response before the handshake is finished. A browser won't allow this for security reasons. Identifying the server by its server certificate is a crucial part of the SSL handshake - before this is completed, the browser cannot be sure that he is talking to the correct server.

That's why the answer is "no". The handshake must be finished before the browser will accept any content coming from the server. Otherwise it would be severely broken.

In case I misunderstood you and you want to send the 302 immediately after the handshake is finished, I see no problem here. The server can answer the request with any Response Code - if it happens to be 302, that's perfectly fine.

share|improve this answer
Thanks! That's what I needed to know. – user548971 Mar 28 '12 at 15:41

No, the the basic flow doesn't match what you're trying to do. Here's the order in which things happen:

  1. Connect

  2. SSL Handshake

    1. certificate exchange

    2. verify certificate hostname against URL hostname

    3. setup crypto

  3. Request (including URL, hostname, POST data, cookies, etc.)

  4. Response, e.g:

    • 200 w/ data
    • 30x with Location: header
    • 404 not found

The protocol is simple but rigid. You can't change the order of these things, nor can you leave out steps. So unless what you're trying to do follows this pattern, it isn't going to work.

share|improve this answer

Short answer, No:

Allowing the redirect before the resolve will defeat the purpose of having a certificate. The certificate needs the be resolved first so it knows that you are on a trusted connection.

This is a chain reaction so if the first thing is untrusted people can just redirect you anywhere

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.