Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I know that by using an .htaccess file I can redirect everyone to https://. However, my SSL certificate complains if all the content isn't served under HTTPS.

Is there a way to convert all the resources to be served under HTTPS without changing all the http:// URLs to https:// in the HTML code?

EXAMPLE: If I type in http://domain.com it will go to https://domain.com. However, the images are not using HTTPS which causes issues. Is there a way to make ALL the resources use HTTPS?

I have this:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www.domain\.com$ [NC]
RewriteRule ^ https://domain.com%{REQUEST_URI} [L,R=301]

However, my EV certificate will vanish because of unsecured content. So I need all the images to also be served under HTTPS.

share|improve this question
    
Your question is a bit fuzzy and I am not entirely sure I understand what your are asking. I am reading that you want to modify resources and I read that as HTML files and other similar resources to include other file types such as PDF etc to result in SSL and HTTPS. I am working on that assumption. SSL over HTTPS is a communications encryption protocol that has nothing to do with the source files of a website. Using the .htaccess file to force the use of HTTPS as a protocol is the correct procedure. There is no modifying of files that results in SSL or HTTPS outside of using .htaccess or the –  closetnoc May 13 at 23:03
    
What code are you using in .htaccess to do the redirect? Is it content-type specific? –  nathangiesbrecht May 14 at 0:35
    
It just does the URL. Is there a way to also do all the content URLs? –  Frank Thornton May 14 at 0:35
1  
Could you post your redirect code? –  nathangiesbrecht May 14 at 0:50

1 Answer 1

up vote 7 down vote accepted

You need to drop the 'http:' prefix from all image (and any other) links on your site. When you do so, your browser will default to whatever protocol the page loads with. For example this is best:

<a href="//www.example.com/">

And this is not:

<a href="http://www.example.com/">

The top example is perfectly valid markup and you will load all your resources over an HTTPS connection with the rewrite you already use. Start using it for all links as it works with both HTTP and HTTPS, so you won't ever have this issue again if you enable or disable SSL.

The only consideration is if you are using a CDN or other third-party hosted content on your site. If you are, the above advice will only work if they make their resources available over HTTPS also.

Once you do this, your EV (Extended validation) certificate will work as you are expecting and you should see all resources on the page load over a secure connection.

share|improve this answer
    
Cool. I did not know you could do that –  Frank Thornton May 14 at 9:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.