Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have this server with multiple domains running CentOS 6.2 and Apache. This server has a SSL certificate installed and working well.

Every time I browse to the main domain, without adding http:// it shows the https part.

For example:

If I type mydomain.com it shows the https page on private_html/index.html instead of public_html/index.html

If I type http://mydomain.com or http://www.mydomain.com it shows the correct page at public_html/index.html

If I type https://mydomain.com or https://www.mydomain.com it shows the correct page at private_html/index.html

the problem is just that if I omit the http or https part it always shows the https part. I want the inverse. I want to go to https when I want, not when apache wants.

What may be causing this?

This is my httpd.conf for this domain

<VirtualHost 100.101.102.103:80 >
        ServerName www.mysite.com
        ServerAlias www.mysite.com mysite.com
        ServerAdmin webmaster@mysite.com
        DocumentRoot /home/admin/domains/mysite.com/public_html
        ScriptAlias /cgi-bin/ /home/admin/domains/mysite.com/public_html/cgi-bin/

        UseCanonicalName OFF

        <IfModule !mod_ruid2.c>
                SuexecUserGroup admin admin
        </IfModule>
        <IfModule mod_ruid2.c>
                RMode config
                RUidGid admin admin
                RGroups apache access
        </IfModule>

        CustomLog /var/log/httpd/domains/mysite.com.bytes bytes
        CustomLog /var/log/httpd/domains/mysite.com.log combined
        ErrorLog /var/log/httpd/domains/mysite.com.error.log
        <Directory /home/admin/domains/mysite.com/public_html>
                Options +Includes -Indexes
                php_admin_flag safe_mode OFF
                php_admin_flag engine ON
                php_admin_value sendmail_path '/usr/sbin/sendmail -t -i -f admin@mysite.com'

                php_admin_value open_basedir /home/admin/:/tmp:/var/tmp:/usr/local/lib/php/
        </Directory>
</VirtualHost>


<VirtualHost 100.101.102.103:443 >
        SSLEngine on
        SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt
        SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key

        ServerName www.mysite.com
        ServerAlias www.mysite.com mysite.com
        ServerAdmin webmaster@mysite.com
        DocumentRoot /home/admin/domains/mysite.com/private_html
        ScriptAlias /cgi-bin/ /home/admin/domains/mysite.com/public_html/cgi-bin/

        UseCanonicalName OFF

        <IfModule !mod_ruid2.c>
                SuexecUserGroup admin admin
        </IfModule>
        <IfModule mod_ruid2.c>
                RMode config
                RUidGid admin admin
                RGroups apache access
        </IfModule>

        CustomLog /var/log/httpd/domains/mysite.com.bytes bytes
    CustomLog /var/log/httpd/domains/mysite.com.log combined
        ErrorLog /var/log/httpd/domains/mysite.com.error.log

        <Directory /home/admin/domains/mysite.com/private_html>
                Options +Includes -Indexes

                php_admin_flag safe_mode OFF
                php_admin_flag engine ON
                php_admin_value sendmail_path '/usr/sbin/sendmail -t -i -f admin@mysite.com'

            php_admin_value open_basedir /home/admin/:/tmp:/var/tmp:/usr/local/lib/php/
        </Directory>
</VirtualHost>

any help is appreciated. Thanks.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

This has nothing to do with apache. Your http service and your https service are on different ports, and this port is specified in the TCP/IP header by the client. Apache is not making an arbitrary choice, it is just doing what it is supposed to do in response to a specific request made on a specific port.

In other words, it is your net client (the browser) which is selecting https when you type directly into the location bar and omit the protocol (http, ftp, https...). If you have a history at that site, the browser will then just pick a match from its internal list.

Although that should happen only with typing in the location bar and not with links within the site, it is probably a good idea to lay the site out without duplicate paths in different protocols to avoid confusion. You can still use the same domain name, just, eg, add "secure" at the beginning of the path (https://my.domain/secure/rest-of-path). If the content apache is serving is supposed to be literally the same for both https and http, use symlinks or mod_rewrite (I think that is appropriate, I'm not a big apache guy) to accomplish this so the end user and web client see those paths as different.

You can set up apache to redirect http requests to the https port and vice versa, but you would know if you had done so. You would also probably be able to find evidence of such a redirect in the server logs, and you could certainly find it by looking at the transaction in wireshark.

I highly recommend using wireshark to debug and learn about HTTP transactions. The "source" and "destination" ports are under "Transmission Control Protocol". These are set by the sender, not the receiver. 80 is normally considered http and 443 is https. It is possible to use non-standard ports for either one, but in that case a normal net client must be told explicitly which port to use (by adding :NNN to the address, eg https://my.domain:4040/path), and obviously the server must be configured to service those ports explicitly too.

share|improve this answer
    
Thanks. I was suspecting the browser was doing this but I have tested it with safari, firefox and chrome and all do the same thing. The problem is that I do not have an equivalent of all pages in the protected area. I suppose I will have to transfer everything to there and create a redirection, right? –  Digital Robot Jan 28 '13 at 11:13
    
All modern browsers will do this kind of thing if you have a history at the site already. They will only do it, however, when typing directly into the location bar if you leave the protocol out (http, https, ftp...). It will not happen if you are following links, etc, so it will not hurt the integrity of the site. You can't solve this serverside because there is no way to tell which requests are real and which are mistakes. The best idea, if the site is not live yet, would be to not have any equivalents so no such confusion can occur; just add something to the path to differentiate them. –  goldilocks Jan 28 '13 at 11:32
    
you are right! the problem is on the browser history. Once visited the https part once the browser will always try to get there. I erased my history to the site and it is now dropping me on the http part as expected. Thanks. Please add this comment of yours as an answer so I can accept it. –  Digital Robot Jan 28 '13 at 14:49
    
Okay, I tacked onto the 2nd and 3rd paragraphs including the suggestion that you not duplicate paths ;) –  goldilocks Jan 28 '13 at 15:04
    
THANKS!!!!!!!!! –  Digital Robot Jan 29 '13 at 13:51

Given today's hardware, the extra cost of HTTPS is minuscule; some sites even recommend configuring using only the HTTPS version, others will redirect to it automatically. Why do you insist in using the insecure HTTP protocol?

share|improve this answer
1  
Using ssl/tls can be a significant performance hit on the server when there are frequent small requests as is the norm for http, I suggest you google this or benchmark it yourself if you are in doubt. Eg serverfault.com/questions/43692/… Leaving public content "insecure" would be considered irrelevant by most people. –  goldilocks Jan 28 '13 at 16:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.