Apache server redirects main domain to https

Question

I have this server with multiple domains running CentOS 6.2 and Apache. This server has a SSL certificate installed and working well.

Every time I browse to the main domain, without adding http:// it shows the https part.

For example:

If I type mydomain.com it shows the https page on private_html/index.html instead of public_html/index.html

If I type http://mydomain.com or http://www.mydomain.com it shows the correct page at public_html/index.html

If I type https://mydomain.com or https://www.mydomain.com it shows the correct page at private_html/index.html

the problem is just that if I omit the http or https part it always shows the https part. I want the inverse. I want to go to https when I want, not when apache wants.

What may be causing this?

This is my httpd.conf for this domain

<VirtualHost 100.101.102.103:80 >
        ServerName www.mysite.com
        ServerAlias www.mysite.com mysite.com
        ServerAdmin webmaster@mysite.com
        DocumentRoot /home/admin/domains/mysite.com/public_html
        ScriptAlias /cgi-bin/ /home/admin/domains/mysite.com/public_html/cgi-bin/

        UseCanonicalName OFF

        <IfModule !mod_ruid2.c>
                SuexecUserGroup admin admin
        </IfModule>
        <IfModule mod_ruid2.c>
                RMode config
                RUidGid admin admin
                RGroups apache access
        </IfModule>

        CustomLog /var/log/httpd/domains/mysite.com.bytes bytes
        CustomLog /var/log/httpd/domains/mysite.com.log combined
        ErrorLog /var/log/httpd/domains/mysite.com.error.log
        <Directory /home/admin/domains/mysite.com/public_html>
                Options +Includes -Indexes
                php_admin_flag safe_mode OFF
                php_admin_flag engine ON
                php_admin_value sendmail_path '/usr/sbin/sendmail -t -i -f admin@mysite.com'

                php_admin_value open_basedir /home/admin/:/tmp:/var/tmp:/usr/local/lib/php/
        </Directory>
</VirtualHost>


<VirtualHost 100.101.102.103:443 >
        SSLEngine on
        SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt
        SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key

        ServerName www.mysite.com
        ServerAlias www.mysite.com mysite.com
        ServerAdmin webmaster@mysite.com
        DocumentRoot /home/admin/domains/mysite.com/private_html
        ScriptAlias /cgi-bin/ /home/admin/domains/mysite.com/public_html/cgi-bin/

        UseCanonicalName OFF

        <IfModule !mod_ruid2.c>
                SuexecUserGroup admin admin
        </IfModule>
        <IfModule mod_ruid2.c>
                RMode config
                RUidGid admin admin
                RGroups apache access
        </IfModule>

        CustomLog /var/log/httpd/domains/mysite.com.bytes bytes
    CustomLog /var/log/httpd/domains/mysite.com.log combined
        ErrorLog /var/log/httpd/domains/mysite.com.error.log

        <Directory /home/admin/domains/mysite.com/private_html>
                Options +Includes -Indexes

                php_admin_flag safe_mode OFF
                php_admin_flag engine ON
                php_admin_value sendmail_path '/usr/sbin/sendmail -t -i -f admin@mysite.com'

            php_admin_value open_basedir /home/admin/:/tmp:/var/tmp:/usr/local/lib/php/
        </Directory>
</VirtualHost>

any help is appreciated. Thanks.

Answer 1

This has nothing to do with apache. Your http service and your https service are on different ports, and this port is specified in the TCP/IP header by the client. Apache is not making an arbitrary choice, it is just doing what it is supposed to do in response to a specific request made on a specific port.

In other words, it is your net client (the browser) which is selecting https when you type directly into the location bar and omit the protocol (http, ftp, https...). If you have a history at that site, the browser will then just pick a match from its internal list.

Although that should happen only with typing in the location bar and not with links within the site, it is probably a good idea to lay the site out without duplicate paths in different protocols to avoid confusion. You can still use the same domain name, just, eg, add "secure" at the beginning of the path (https://my.domain/secure/rest-of-path). If the content apache is serving is supposed to be literally the same for both https and http, use symlinks or mod_rewrite (I think that is appropriate, I'm not a big apache guy) to accomplish this so the end user and web client see those paths as different.

You can set up apache to redirect http requests to the https port and vice versa, but you would know if you had done so. You would also probably be able to find evidence of such a redirect in the server logs, and you could certainly find it by looking at the transaction in wireshark.

I highly recommend using wireshark to debug and learn about HTTP transactions. The "source" and "destination" ports are under "Transmission Control Protocol". These are set by the sender, not the receiver. 80 is normally considered http and 443 is https. It is possible to use non-standard ports for either one, but in that case a normal net client must be told explicitly which port to use (by adding :NNN to the address, eg https://my.domain:4040/path), and obviously the server must be configured to service those ports explicitly too.

Answer 2

Given today's hardware, the extra cost of HTTPS is minuscule; some sites even recommend configuring using only the HTTPS version, others will redirect to it automatically. Why do you insist in using the insecure HTTP protocol?