0

I have setup a test website in order to play around setting up SSL. The website is setup on a Windows host with Apache 2.2.20 with OpenSSL 0.9.8r, MySQL 5.5.37, PHP 5.3.28. The URL to the home page of the website is http://example.com/index.php. Once you get to the index.php page, you are instantly redirected to http://example.com/login.php.

I setup SSL with a self-signed cert. When I navigated to index.php on https, I get the error stating the certificate does not match the server. I click on "Continue to this website (not recommended)." I receive the message "You are about to view pages over a secure connection." I select ok, and I immediately receive the message "You are about to leave a secure Internet connection." I select yes I want to continue. IE errors out and states "Internet Explorer cannot display the webpage."

If I navigate directly to login.php on https, it works as expected.

My question is... What would be causing Apache to start loading secure and then switching to unsecure?

Improve this question
2
  • You are redirecting without taking the scheme into account, probably.
    – Ry-
    Jul 6, 2014 at 17:25
  • What do you redirect to? Do you include the schema? Are you listening on both 80 and 443?
    – ndrix
    Jul 7, 2014 at 8:24

1 Answer 1

Reset to default
1

It is very likely that you're simply doing something like this:

<?php

if ( ! $is_logged_in) {
    header('Location: http://example.com/login.php');
    exit;
}

Just change your redirect url to https, and everything should work as intended.

Improve this answer
4
  • In this case it is best to leave the protocol completely. Just redirect to /login.php and the browser will handle http/https.
    – marstato
    Jul 7, 2014 at 13:06
  • I think it's required (according to specifications) to include the full url in redirect headers. A vast majority of browsers will handle relative URLs correctly, but it might cause problems in some cases. Also, having the https protocol present ensures that http:/example.com will always redirect to the secure login page.
    – Joel L
    Jul 7, 2014 at 13:12
  • Well, thats a difference. Anyways, I'd use a constant WEBROOT instead of hardcoding the https or the domain, just best-practice.
    – marstato
    Jul 8, 2014 at 8:59
  • @marstato — yes, certainly. Or probably something like an appliction-specific get_full_url('login') helper.
    – Joel L
    Jul 8, 2014 at 9:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .