5

I know that by using an .htaccess file I can redirect everyone to https://. However, my SSL certificate complains if all the content isn't served under HTTPS.

Is there a way to convert all the resources to be served under HTTPS without changing all the http:// URLs to https:// in the HTML code?

EXAMPLE: If I type in http://domain.com it will go to https://domain.com. However, the images are not using HTTPS which causes issues. Is there a way to make ALL the resources use HTTPS?

I have this:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www.domain\.com$ [NC]
RewriteRule ^ https://domain.com%{REQUEST_URI} [L,R=301]

However, my EV certificate will vanish because of unsecured content. So I need all the images to also be served under HTTPS.

Improve this question
4
  • Your question is a bit fuzzy and I am not entirely sure I understand what your are asking. I am reading that you want to modify resources and I read that as HTML files and other similar resources to include other file types such as PDF etc to result in SSL and HTTPS. I am working on that assumption. SSL over HTTPS is a communications encryption protocol that has nothing to do with the source files of a website. Using the .htaccess file to force the use of HTTPS as a protocol is the correct procedure. There is no modifying of files that results in SSL or HTTPS outside of using .htaccess or the
    – closetnoc
    Commented May 13, 2014 at 23:03
  • What code are you using in .htaccess to do the redirect? Is it content-type specific?
    – nathangiesbrecht
    Commented May 14, 2014 at 0:35
  • It just does the URL. Is there a way to also do all the content URLs?
    – Jason
    Commented May 14, 2014 at 0:35
  • 1
    Could you post your redirect code?
    – nathangiesbrecht
    Commented May 14, 2014 at 0:50

2 Answers 2

Reset to default
9

You need to drop the 'http:' prefix from all image (and any other) links on your site. When you do so, your browser will default to whatever protocol the page loads with. For example this is best:

<a href="//www.example.com/">

And this is not:

<a href="http://www.example.com/">

The top example is perfectly valid markup and you will load all your resources over an HTTPS connection with the rewrite you already use. Start using it for all links as it works with both HTTP and HTTPS, so you won't ever have this issue again if you enable or disable SSL.

The only consideration is if you are using a CDN or other third-party hosted content on your site. If you are, the above advice will only work if they make their resources available over HTTPS also.

Once you do this, your EV (Extended validation) certificate will work as you are expecting and you should see all resources on the page load over a secure connection.

Improve this answer
1
  • Cool. I did not know you could do that
    – Jason
    Commented May 14, 2014 at 9:26
2

As a quick fix, you can ask the web browser to rewrite all your HTTP URLs as HTTPS by sending the Content-Security-Policy: upgrade-insecure-requests; header or <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests"> meta tag with every page.

This is not meant to be used as a permanent solution, but as as a transition tool until you can get all your URLs converted to https.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.