13

I have recently had an active website that was protected by an SSL certificate. The site is no longer active and the certificate has expired. I have tried to put up a simple HTML holding page but Google will not show it because there is an expired certificate associated with the domain. Is there a solution to allow me to display the page without needing a certificate.

Improve this question
2
  • 9
    The core problem here is you somehow want to disable the HTTPS for the site because it is dormant. If you ask me, that is not an SSL, HTTPS or even HSTS issue. Rather it is the fact your web server is only serving HTTPS pages by default. One “solution” is to have your web server stop serving HTTPS pages act all and just have them serve plain HTTP pages. And that is a “solution” that is not the greatest solution since it means tons of web browsers will make some noise about the page not being secure. But it is a simple way to park a dormant domain without needing to have a certificate.
    – Giacomo1968
    Commented Jun 20, 2021 at 3:06
  • 12
    Even for a static placeholder it's not a bad idea to just setup LetsEncrypt to provide HTTPS for the site. scotthelme.co.uk/still-think-you-dont-need-https
    – BlueCacti
    Commented Jun 21, 2021 at 11:57

3 Answers 3

Reset to default
43

It sounds like your site may have been serving a HSTS header during the time when it was secured with the SSL certificate. If you are not familiar with HSTS, see https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security.

In particular:

It allows web servers to declare that web browsers (or other complying user agents) should automatically interact with it using only HTTPS connections

and

HSTS Policy specifies a period of time during which the user agent should only access the server in a secure fashion.

If that's the case, then

  1. Browsers that previously connected to your site by https will be not be able to connect to your site by http until the HSTS directive expires.
  2. Browsers that never connected to your site previously will be able to connect to your site by http now.

Having said that, SSL has never been simpler and less expensive to deploy (especially if you use Let's Encrypt). You might want to simply renew your SSL certificate to solve the problem of (1) above.

Improve this answer
10
  • 31
    @Giacomo1968: No, if the browser has detected an HSTS header for that domain, it will refuse to connect to it again with HTTP, even if connection is refused by the server at 443. Remember that a man-in-the-middle could return rogue refusal packets to force a downgrade otherwise.
    – user000001
    Commented Jun 20, 2021 at 6:09
  • 1
    @user000001 Aaaahhhhh… Got it. But it still seems possible to disable HSTS headers via <VirtualHost *:443>Header always set Strict-Transport-Security "max-age=0"</VirtualHost> as explained on this Server Fault answer.
    – Giacomo1968
    Commented Jun 20, 2021 at 16:20
  • 17
    @Giacomo1968: The point is that browsers that previously connected to you site will never see that header because they will never connect with plain HTTP.
    – President James K. Polk
    Commented Jun 20, 2021 at 16:57
  • 8
    You can't easily downgrade a HTTPS site back down to HTTP, because that's exactly what man-in-the-middle attacks would do to hijack you. This is simply not something you want to get working because it means you discovered a MITM vulnerability. Just register a free SSL for 3 months telling them the site is down, and then take it completely down after.
    – Nelson
    Commented Jun 21, 2021 at 8:23
  • 4
    @PresidentJamesK.Polk Well, not never, only until the original max-age expires
    – Hagen von Eitzen
    Commented Jun 21, 2021 at 14:33
2

Why not using a free certificate instead https://letsencrypt.org/? You can have a secure website that will not be blocked by modern browsers. This is pretty straight forward and it's the fastest or smartest solution than modifying config files.

Also please make sure you check your website headers.

Personally, I use Mozilla Observatory. That way you can have your site checked for things like TLS/HTTP Headers/Cookies, etc and you get scores for each category and solutions in case they are needed.

Improve this answer
1

Glad that HSTS worked out to work for you, but in case other people have this problem (and the accepted answer does not work) many websites still use redirects to enforce HTTPS. This is usually going to be small bit of code in the htaccess or web.config file that simply redirects all HTTP requests to HTTPS.

Improve this answer
2
  • Yes, but it's important to point out that HTTP->HTTPS redirects represent a significant vulnerability.
    – President James K. Polk
    Commented Jun 21, 2021 at 16:56
  • 1
    Hehe, I said it was common, not a good idea.
    – Nosajimiki
    Commented Jun 21, 2021 at 18:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .