3

I am implementing to adopt a site from http to https, I am using the Let's Encrypt in cPanel, I am in a shared hosting environment.

This is how I implement it:

  1. Site in maintenance mode
  2. Issue the SSL Certificate
  3. Adding this code in .htaccess:

    RewriteEngine On
    RewriteCond %{SERVER_PORT} 80
    RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]
    
  4. Deleting all sessions in session folder to redirect them in login page. Or delete the all the cookies stored in database.

  5. Test it

  6. Maintenance mode is off

Is this the right thing to do? If not, please do tell me how to do it.

Update

I tested this .htaccess code to follow the guidelines of https://hstspreload.org:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^example.com [NC]
RewriteRule ^(.*)$ https://example.com/$1 [L,R=301,NC]

RewriteCond %{HTTPS} !on [OR]
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule (.*) https://www.example.com%{REQUEST_URI} [L,R=301]

<IfModule mod_headers.c>
Header set Strict-Transport-Security "max-age=10886400; includeSubDomains; preload"
</IfModule>

This me a medium warning:

Warning: Unnecessary HSTS header over HTTP The HTTP page at http://example.com sends an HSTS header. This has no effect over HTTP, and should be removed.

  • If the results of step 5. Test it, show that it worked, then seems good. Deleting the cookies in the database might be extreme. Do the cookies store user preferences that they will be unhappy about loosing? Might consider adding step 2.5 Test HTTPS functionality, before doing the forced redirection. – Gypsy Spellweaver Feb 21 '17 at 4:17
  • I tested this in localhost, I need to clear the cache (Mozilla FireFox) inorder for the rewrite to work. – Dumb Question Feb 21 '17 at 4:18
  • @GypsySpellweaver how I can test https functionality? – Dumb Question Feb 21 '17 at 4:20
  • 1
    Before you force the redirection, try to load the page in HTTPS manually. Browser address bar type httpd://example.com obviously changing it to your domain name. If you have multiple domains in the cert, do that for every domain listed. Then it's safe to force the redirects. Nothing says "oops" like redirecting to a dead page, or a misconfigured security cert. – Gypsy Spellweaver Feb 21 '17 at 4:25
  • this plugin for cPanel/WHM worked for me. – Jan Mar 6 '17 at 7:42
3

I run a web hosting business. Hundreds of clients are (or aren't if they are lazy) switching to https via free LetsEncrypt certificates.

To be honest, I think you are overcomplicating things. Install the SSL for the domain, then without changing anything, try using https and see how you go.

You might find a bunch of mixed-content warnings when viewing the developer tools console. This is one of the most important steps as if there is any mixed content i.e. files included using http, you will not see a secure padlock.

There is no need to put a site into maintenance mode. Even if you have the certificate installed, people can still use the legacy http while you are testing.

Then when your are satisfied it is working, add the code to your .htaccess file.

Here's how you test: go to htps://example.com and see if there is a padlock in the address bar. If there is, it is working. If there is still an insecure notification, back to developer tools to look for the problems.

  • okay I will do this, is LetsEncrypt will be free after it expires? – Dumb Question Feb 21 '17 at 9:36
  • 2
    LetsEncrypt needs to be renewed when it expires (3 months). It is free to renew, but it happens often enough that renewals should be automated. – Stephen Ostermiller Feb 21 '17 at 10:14
  • 2
    LetsEncrypt is most often automated, either via cpanel AutoSSL or if it is set up to do so on the server. If you don't have root access, check with your host, it won't be long before LetsEncrypt becomes the standard. They have already disrupted the entire SSL financial model...good on them...it was a rort. – Steve Feb 21 '17 at 11:39
2

I would not do it as you propose. My suggestion gives you more control over the process resulting as as few errors for your visitors as possible:

  • Implement LetsEncrypt / https but don't set any redirects yet
  • Now type https:// in your url and check it yourself. Do/fix as much test as you can/like1.
  • If you're confident you've got most of it, get a group of users which you tell about the https to do the same (or redirect just this group), usage always reveals more problems.
  • When you feel you've done all you can, implement the redirect to https 1
  • Keep checking your reports, possible 404's etc. Again, real usage always reveals errors you haven't found, be prepared for this (if you're lucky it a simply typo).
  • After a sufficient amount of time, implement HSTS, this way your site isn't accessable via http.

1 I suggest you link to external files like this: //www.example without either http: or https: in the URI
2 No need to remove sessions as they either transfer with you to to the https (unlikely) or they simply expire on the spot. Your users will have to login again if they're switched to https (you might want to give them a heads up).

  • I got this error from mozilla firefox imgur.com/a/hwiXU, though no details appeared. – Dumb Question Feb 21 '17 at 14:12
  • It worked now and this error appeared Unknown property ‘-moz-border-radius’. Declaration dropped., 1273 of them. Even in http:// this error appeared. – Dumb Question Feb 21 '17 at 14:21
  • 1
    You might want to get someone more skilled to look at your code, because you've just got erors in 4 different parts of your website, which all require another solution. Unfortunally, this site is not the type of forum to help you with all these types or errors. – Martijn Feb 21 '17 at 14:42
  • 1
    There is a lot of documentation to be found about the subject – Martijn Feb 21 '17 at 14:42
  • 1
    The link provided in my answer explains it better than I can do in a comment – Martijn Feb 22 '17 at 8:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.