I have setup a test website in order to play around setting up SSL. The website is setup on a Windows host with Apache 2.2.20 with OpenSSL 0.9.8r, MySQL 5.5.37, PHP 5.3.28. The URL to the home page of the website is http://example.com/index.php. Once you get to the index.php page, you are instantly redirected to http://example.com/login.php.

I setup SSL with a self-signed cert. When I navigated to index.php on https, I get the error stating the certificate does not match the server. I click on "Continue to this website (not recommended)." I receive the message "You are about to view pages over a secure connection." I select ok, and I immediately receive the message "You are about to leave a secure Internet connection." I select yes I want to continue. IE errors out and states "Internet Explorer cannot display the webpage."

If I navigate directly to login.php on https, it works as expected.

My question is... What would be causing Apache to start loading secure and then switching to unsecure?

  • You are redirecting without taking the scheme into account, probably. – Ry- Jul 6 '14 at 17:25
  • What do you redirect to? Do you include the schema? Are you listening on both 80 and 443? – ndrix Jul 7 '14 at 8:24

It is very likely that you're simply doing something like this:


if ( ! $is_logged_in) {
    header('Location: http://example.com/login.php');

Just change your redirect url to https, and everything should work as intended.

  • In this case it is best to leave the protocol completely. Just redirect to /login.php and the browser will handle http/https. – marstato Jul 7 '14 at 13:06
  • I think it's required (according to specifications) to include the full url in redirect headers. A vast majority of browsers will handle relative URLs correctly, but it might cause problems in some cases. Also, having the https protocol present ensures that http:/example.com will always redirect to the secure login page. – Joel L Jul 7 '14 at 13:12
  • Well, thats a difference. Anyways, I'd use a constant WEBROOT instead of hardcoding the https or the domain, just best-practice. – marstato Jul 8 '14 at 8:59
  • @marstato — yes, certainly. Or probably something like an appliction-specific get_full_url('login') helper. – Joel L Jul 8 '14 at 9:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.