I've searched a lot, i also tried lots of thing but still cannot find the problem.  I have an apache 2.2.22 server installed on an ubuntu server 12.04 lts. I have a number of http virtual hosts and 2 https vhosts. Everything works fine, but the strange thing is that if i give on my browser one of my http sites, with https instead, it redirects me to the actual https site. This is very awkward an i really don't know what is causing it.  Has anyone faced that too? and can you help with this? Thanks in advance
398
This is a  about Hosting multiple SSL websites on the same IP.   I was under the impression that each SSL Certificate required it's own unique IP Address/Port combination. But the  is at odds with this claim.  Using information from that Question, I was able to get multiple SSL certificates to work on the same IP address and on port 443. I am very confused as to why this works given the assumption above and reinforced by others that each SSL domain website on the same server requires its own IP/Port.  I am suspicious that I did something wrong.  Can multiple SSL Certificates be used this way?
25732
I have one nginx server setup(two config files) with two gunicorn web servers setup and running. One gunicorn is production and the other is staging.   I want nginx to serve http requests to xyz.com as well as https requests to xyz.com to the production gunicorn server @ 127.0.0.1:8000.    I have accomplished this with:  server {    listen 80;    server_name xyz.com;    return 301 https://$http_host$request_uri; }  server {    listen 443 ssl;    server xyz.com;    ..... &lt;&lt;&lt; ssl stuff   location /{       .... proxy_stuff       proxy_pass http://127.0.0.1:8000;   } }   I also want http traffic to xyz.com:8080 and https traffic to xyz.com:8080 to hit the staging server @ 127.0.0.1:8081. I have been been able to get https traffic to xyz.com:8080 working as follows:  server {    listen 8080 ssl;    server_name xyz.com;    ...... &lt;&lt; ssl stuff    location / {       ...... &lt;&lt; proxy stuff       proxy_pass http://127.0.0.1:8081;    } }   But I can't seem to find a way to redirect http traffic at xyz.com:8080 to https traffic at xyz.com:8080. I have tried the same redirection that I did with port 80 but have not been successful.   Could use some direction.
96398
Im an intermediate Linux user and got assigned the task to make Apache run https connections. Currently running centOS 6 and my problem is following:  installed mod_ssl and tried to set up  paths correctly but not sure if i used the right files. I have class2-root.crt and root-2-int.cer also i was given a wildcard.ssl.pfx. i have realized that there is a variable that has to point to ".key" file which i don't have. So generated that using:  openssl req -new -keyout server.key -out server.csr  there are plenty of sources showing how to do this online and tried many times but no luck. I just need someone who would help according to my case to tell me what files i only need to touch and configure. Also if the key has to be from the same source as the certs i have? and what certs i need from what i was given?  what i did exactly is this in httpd.conf:  &lt;VirtualHost *:443&gt; DocumentRoot /var/www/html ServerName MyServer_Ip_Adress SSLEngine on SSLCertificateFile /etc/ssl/crt/class-root.crt SSLCertificateKeyFile /etc/ssl/crt/server.key SSLCertificateChainFile /etc/ssl/crt/root-2int.cer &lt;/VirtualHost&gt;   after this couldn't stop Apache nor restart it. Stopping will always fail.
17146
Goals:   If the user support SNI and hit myurl1.server.com (https) or myurl2.server.com (https) it will match the right vhost. (the last 2 vhosts) If the user does not support SNI and hit myurl1.server.com (https) or myurl2.server.com (https) it will be catch by the fallback vhost (the first on port 443). It contains the SAN certificate and it  will hit the server again to do the match. This time it will hit the last 2 vhost.  If the user enter an unknown url with either http or https it will be catch in the first vhost that show a error page.   I have tested all 3 goals and it's working fine.  Questions:   When the user is hitting the SAN vhost (https) which make a new request to it self. How does Apache know it will match the last 2 vhost (443) when the proxypass in SAN vhost is using http(80) When the user is hitting the SAN vhost I can't see any requests in the SAN access log. The requests only appears in the  last 2 vhost even if it goes through the SAN vhost. However I can see some bot requests in the SAN access log.   The code only contains the important parts.  NameVirtualHost *:80 NameVirtualHost *:443  &lt;VirtualHost *:80&gt;   show error page &lt;/VirtualHost&gt;  &lt;VirtualHost *:443&gt;   SSLCertificateFile san.crt   CustomLog san-access.log    ProxyPass / http://my-local-url-server/   ProxyPassReverse / http://my-local-url-server/ &lt;/VirtualHost&gt;  &lt;VirtualHost *:443&gt;   ServerName myurl1.server.com   SSLCertificateFile myurl1.crt   CustomLog myurl1-access.log    ProxyPass / http://mybackend1/   ProxyPassReverse / http://mybackend1/ &lt;/VirtualHost&gt;  &lt;VirtualHost *:443&gt;   ServerName myurl2.server.com   SSLCertificateFile myurl2.crt   CustomLog myurl2-access.log    ProxyPass / http://mybackend2/   ProxyPassReverse / http://mybackend2/ &lt;/VirtualHost&gt;
82636
I want to rewrite all http requests on my web server to be https requests, I started with the following:   server {     listen      80;      location / {       rewrite     ^(.*)   https://mysite.com$1 permanent;     } ...    One Problem is that this strips away any subdomain information (e.g., node1.mysite.com/folder), how could I rewrite the above to reroute everything to https and maintain the sub-domain?
124288
I need a single Wordpress installation to be available from both the main domain (www.example.com) via HTTP and a subdomain (secure.example.com) via HTTPS.  Of course i can just map the subdomain to the Wordpress folder in Nginx config. But will Wordpress be aware that it is called via HTTPS and change all links on the pages to HTTPS ?  Also, how i can i force certain pages to be automatically redirected to their HTTPS equivalent permalink (and then back again to HTTP) ?
117347
I am working on an apache2 reverse proxy vhost. When the server behind apache is down, the first request to apache shows the error page of course.   But at subsequent requests it seems apache delays for some time before asking the backend server again. During all this time (which is short but in development I don't want a delay at all) only the apache error page is shown to the browser, although the backend server is already up.  Where is this setting in apache, what is this behaviour, and how can I set the delay time to zero?  Edit: I am not trying to change the timeout for a single request. I want to change the blocking time. It is my experience that apache blocks further requests for a certain time before asking a backend server again that has failed once.   Edit2: This is what apache delivers:  Service Temporarily Unavailable  The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.  Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.7 with Suhosin-Patch proxy_html/3.0.0 Server at localhost Port 80  After hitting Ctrl-R in firefox for 60 seconds the page finally appears.
31987
In my site I'm redirecting everything (http://, http://www., https://) to https://www.example.com.  Google webmaster tools says: Make sure you add both "www" and "non-www" versions for your site. Also, if you use the HTTPS protocol, add those variations as well.  So I've added all the FOUR versions to google webmaster tools. Is this a correct process?
821
So it looks like Stack Exchange now supports HTTPS (to some extent). Which is awesome! But there are a few problems, the main one being that some content is delivered over the CDN, which is plain HTTP. This causes browsers to complain about "unsecured content":
99036
Apache was installed on my debian,i want to bind two domain name with different directroy.  cat  /etc/hosts 127.0.0.1  hwy.local  www.hwy.local   127.0.0.1  test.app   www.test.app   Two domain name all binded with  127.0.0.1.  cat   /etc/apache2/sites-available/000-default.conf  &lt;VirtualHost *:80&gt;     ServerName www.hwy.local     ServerAdmin webmaster@localhost     DocumentRoot /var/www/html     ErrorLog ${APACHE_LOG_DIR}/error_hwy.log     CustomLog ${APACHE_LOG_DIR}/access_hwy.log combined         &lt;Directory /var/www/html&gt;             Options Indexes FollowSymLinks MultiViews             AllowOverride None             Order allow,deny             allow from all         &lt;/Directory&gt; &lt;/VirtualHost&gt; &lt;VirtualHost *:80&gt;  ServerName www.test.app ServerAdmin webmaster@localhost DocumentRoot  /home/debian9/app ErrorLog ${APACHE_LOG_DIR}/error_app.log CustomLog ${APACHE_LOG_DIR}/access_app.log combined     &lt;Directory /home/debian9/app&gt;         Options Indexes FollowSymLinks MultiViews         AllowOverride None         Order allow,deny         allow from all     &lt;/Directory&gt; &lt;/VirtualHost&gt;   Save the same file test.html  in both /var/www/html and /home/debian9/app.  &lt;p&gt;it is a test&lt;/p&gt;   Why www.hwy.local/test.html can open it ,www.test.app  run into error.  This site can’t be reached
70727
I can't connect to  or  &mdash; the initial connection times out every time. I check this every week, and it worked fine last time, so it must be something pretty recent. (Further HTTPS deployment?)
43927
I'm looking for a way to force SSL and www.  I've been able to force both separately but together I keep running into redirection issues. The following code works when handling a URL in this format: http://example.com and properly redirects to https://www.example.com but when the incoming URL is https://example.com it will not forward to https://www.example.com - Any suggestions?  EDIT: it should also send http://www.example.com to https://www.example.com.  RewriteCond %{REMOTE_ADDR} !127\.0\.0\.0 RewriteCond %{SERVER_PORT} 80 RewriteCond %{HTTP_HOST} !^www.example\.com$ RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]
11528
I wonder what is the relationship of ServerName &amp; ServerAlias with host.file. As I know ServerName sets the hostname and port that the server uses to identify itself and ServerAlias is the alternate names for a host. But does the ServerName and ServerAlias need to be identified in host.file? Do we need to put the exact domain name or it can be an alternate name in ServerName or ServerAlias? Let's say my actual domain is www.example.com and I have set up SSL and my website are now run as https+www.example.com, now I'm trying to redirect my website from http+example.com when I type it in the browser and I expect my browser will redirect me to https+www.example.com,  what ServerName or ServerAlias should I put in httpd-vhost.conf? Below are my host.file:  127.0.0.1 example.com www.example.com ::1 example.com www.example.com 127.0.0.1 localhost ::1 localhost   Below are my httpd-vhosts.conf:  &lt;VirtualHost *:80&gt;     ServerName example.com     ServerAlias www.example.com     DocumentRoot "d:/wamp64/www/example"     &lt;Directory  "d:/wamp64/www/example/"&gt;         Options +Indexes +Includes +FollowSymLinks +MultiViews         AllowOverride All         Order allow,deny         Allow from all         Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"     &lt;/Directory&gt; &lt;/VirtualHost&gt;   Does my definition of ServerName and ServerAlias correct in httpd-vhosts.conf?  This is what I put in .htacess to redirect my website from http+example.com to https+ww.example.com but it does not work and I believe it related with my definition of ServerName and ServerAlias:  RewriteCond %{HTTPS} !on  RewriteCond %{HTTP_HOST} ^example\.com$ RewriteRule .* https://www.example.com%{REQUEST_URI} [R=301,L]   Below is the outcome of my redirection logs:  [perdir D:/wamp64/www/example/] RewriteCond: input='off' pattern='!on' =&gt; matched  [perdir D:/wamp64/www/example/] RewriteCond: input='' pattern='^example\\.com$' =&gt; not-matched   This is what I get from Firefox debugger:    Update  I've update my .htaccess to below:  RewriteCond %{HTTP_HOST} example.com [NC] RewriteRule .* https://www.example.com%{REQUEST_URI} [R=301,L]   I update my ServerName in vhost to www.example.com  Here's the logs that I got:  example per-dir prefix: D:/wamp64/www/example/index.php/news-and-events/news-and-events/news -&gt; index.php/news-and-events/news-and-events/news applying pattern '.*' to uri 'index.php/news-and-events/news-and-events/news' RewriteCond: input='off' pattern='!on' =&gt; matched RewriteCond: input='www.example.com' pattern='example.com' [NC] =&gt; matched rewrite 'index.php/news-and-events/news-and-events/news' -&gt; 'https://www.example.com/index.php/news-and-events/news-and-events/news' explicitly forcing redirect with https://www.example.com/index.php/news-and-events/news-and-events/news trying to replace prefix D:/wamp64/www/example/ with / escaping https://www.example.com/index.php/news-and-events/news-and-events/news for redirect redirect to https://www.example.com/index.php/news-and-events/news-and-events/news [REDIRECT/301]   Here is what I got from firefox debugger raw header:  GEThttp://example.com/  Request URL:http://example.com/ Request Method:GET  Request Headers (328 B)  Raw Headers Host: example.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:74.0) Gecko/20100101 Firefox/74.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1   This is what I get from Microsoft Edge:  General Request URL: http://example.com/ Referrer Policy: no-referrer-when-downgrade Request Headers Provisional headers are shown Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36 Edg/80.0.361.111   Please help and do point me out if I've done anything wrong and thanks in advance!
6945
When looking at my Apache2 access logs, I occasionally see GET requests asking my server for a page on a completely different server. For example:  xx.xx.xx.xx - - [18/Jan/2012:07:12:10 -0500] "GET http://someotherserver.com/?sometimesmorestuff=likethis HTTP/1.1" 200 389 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12"   I remembered reading something about that in the past, but at the time I had never seen that on my server, so I didn't worry about it.   Now that I am seeing it on my server, I just ran a test and it appears that my site does indeed serve requests for content from other servers. This seems like a bad thing. So, two questions:  A) Is this something I should be worrying about?  B) How can I fix it?  I've tried a little Googling, but I don't even know what this sort of thing is called, and that makes it difficult.
104675
I started weeding through my site's search results from Google today, using a site: search, to determine if there are any links that cause 404s and thus need redirecting. To my amazement I noticed numerous https:// results relating to various pages. My site doesn't have a SSL certificate, doesn't serve such pages, doesn't internally link to https:// pages, doesn't include any such files in its sitemap.xml and, for all of these, never has.  I decided to do a Google search for https://&lt;my site&gt; and found one site that incorrectly refers to the root of my site with a https:// prefix - I will try to contact them to get them to correct this.  I'm not sure however how Googlebot managed to index the non-root files as https://. I can't find any external links to them and surely, without certification, Googlebot should have stalled at the first request?  I've just added the following lines to the site's .htaccess (although the surfer still has to navigate through the browser's "This site is a security risk. Abandon hope all ye who enter here!" message(s) first to get there):  RewriteEngine On RewriteCond %{HTTPS} on RewriteRule ^(.*)$ http://www.&lt;my site&gt;.org/$1 [R=301,L]    replacing &lt;my site&gt; with my domain name.   My big question is this though - I would like to use the Google Webmaster Tools Remove URLs feature to remove the https:// pages from the index. Can I be guaranteed that this will only remove the https:// versions of each relevant page and not the valid http:// versions?  My thanks to anyone who can help me out with this particular question and the issue in general.
104519
Not sure if this belongs here or at serverfault...  I've seen websites where, to login to the website, requires a digital certificate to be installed for the user logging in. As far as I can tell, this certificate is in addition to the website using an SSL certificate (https)  I'm just looking to be pointed in the right direction on how to code for this (apache / php hopefully), who issues these certificates (must it be a trusted var or can I ?) or even what to search for via google.  -Mario
102401
I have two domains : my-domain.com and my-domain.fr  I want to redirect traffic as followed :   my-domain.com:80 -> my-domain.com:443 my-domain.fr:80 -> my-domain.com:443 my-domain.fr:443 -> my-domain.com:443   I've chosen to only use .com, am I right ? I guess yes. Because I only have to manage one certificate : the .COM one.  My /etc/apache2/sites-available/default :  NameVirtualHost *:80  &lt;VirtualHost *:80&gt;    ServerName www.my-domain.com    ServerAlias my-domain.com    Redirect permanent / https://www.my-domain.com &lt;/VirtualHost&gt;  &lt;VirtualHost *:80&gt;    ServerName www.my-domain.fr    ServerAlias my-domain.fr    Redirect permanent / https://www.my-domain.com &lt;/VirtualHost&gt;   My /etc/apache2/sites-available/default-ssl :  NameVirtualHost *:443  &lt;VirtualHost *:443&gt;    ServerName www.my-domain.com    ServerAlias my-domain.com    DocumentRoot /var/www/my-domain/    ErrorLog /var/log/my-domain/my-domain.com.error.log    CustomLog /var/log/my-domain/my-domain.com.access.log combined     GnuTLSEnable on    GnuTLSPriorities NORMAL    GnuTLSExportCertificates on    GnuTLSCertificateFile /etc/apache2/ssl/certs/my-domain.com.crt    GnuTLSKeyFile /etc/apache2/ssl/private/my-domain.com.key &lt;/VirtualHost&gt;  &lt;VirtualHost *:443&gt;    ServerName www.my-domain.fr    ServerAlias my-domain.fr    DocumentRoot /var/www/my-domain/    ErrorLog /var/log/my-domain/my-domain.fr.error.log    CustomLog /var/log/my-domain/my-domain.fr.access.log combined     GnuTLSEnable on    GnuTLSPriorities NORMAL    GnuTLSExportCertificates on    GnuTLSCertificateFile /etc/apache2/ssl/certs/my-domain.fr.crt    GnuTLSKeyFile /etc/apache2/ssl/private/my-domain.fr.key &lt;/VirtualHost&gt;   But I'm getting a SSL certificate error when I'm going to my-domain.fr because it tells me that I wanted to go on my-domain.fr and I'm not.