How to redirect http to https

Question

Well surely there must already be a question very similar to this in stackoverflow.

But before they mark it as a duplicate, I have a specification that I haven’t found any "equal" question to this one that I’m going to ask.

Well I intend to do this:

I have several domains whose virtualhost points to the same physical path /www/site/public_html.

However the example.com domain, I bought ssl and it has https.

What I intended to do was an htacess file that would make me redirect http:// and www to https for my example domain.com.

However, I do not want the other domains to be affected, in other words I do not want the other domains to be https.

In short:

Make 1 condition that if the user comes from http:// example.com or www.exemplo.com to automatically redirect to https:// example.com however, if it comes from another domain do nothing.

How could this be done?

<VirtualHost *:80>
    ServerName www.foo.bar
    Redirect / https://www.foo.bar/
</VirtualHost>

<VirtualHost *:443>
    ServerName www.foo.bar
    # ... Configuração SSL
</VirtualHost>

Thank you.

Answer 1

This is a very simple alternative:

RewriteEngine On 
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} ^(www\.)?domain\.com$ [NC]
RewriteRule ^.*$ https://www.domain.com%{REQUEST_URI} [R,L]

If you’d prefer it all to go without www, change the last line by

RewriteRule ^.*$ https://domain.com%{REQUEST_URI} [R,L]

If you prefer to keep the www equal typed, exchange the last line for

RewriteRule ^.*$ https://%1domain.com%{REQUEST_URI} [R,L]

Remembering that if you put the certificate in the same IP of the sites SEM certificate, and someone tries to access https://site-sem-certificado.com.br will give error anyway, because the SSL negotiation comes before apache process page.

And that’s why a site with HTTPS puts itself on a unique IP (or if it spends money on certificates for multiple domains).

_{Edit: it’s been a while since browsers have negotiated the domain name on Handshake, so it’s very common to have multiple domains on the same IP (there are still cases of "mixing" that will give problem with wrong certificate). At the time of the answer it was still problematic to rely on this support for important things. Still, with free alternatives like Let’s Encrypt, it is recommended to have HTTPS at all.}

Answer 2

Rewriterule is no longer recommended according to Apache documentation.

For the same effect, the recommended method is redirect:

<VirtualHost *:80>
    ServerName www.site.com
    Redirect / https://www.example.com/
</VirtualHost>

You will then also need to configure the service that will offer HTTPS:

<VirtualHost *:443>
    ServerName www.example.com
    SSLEngine On
    SSLCertificateFile /etc/ssl/localcerts/www.example.com.crt
    SSLCertificateKeyFile /etc/ssl/localcerts/www.example.com.key
    SSLCACertificateFile /etc/ssl/localcerts/ca.pem  # Se estiver utilizando um certificado auto-emitido, omita essa linha
</VirtualHost>

Source.