Subdomain rewrites without using certs that don't support sub domain affecting

Question

I am using LetsEncrypt to generate and renew my certs for my website. Unfortunately, it does not support subdomains.

Having said that, I have a ton of rewrite rules that work fine. For example:

RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ http://www.example.com/$1 [L,R=301]
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://www.example.com/$1 [L,R=301]
RewriteRule ^(.*)index\.(php|html?)$ /$1 [R=301,NC,L]

The above will properly take the URL and do its magic. User sessions and cookies get set in the proper path etc ...

In order for me to try and mimic subdomains, I have the following rewrite rule which is currently disabled.

#RewriteRule ^(.*)$ http://example.com/getsub.php?membername=%1 [L,NC,QSA]

Basically, it grabs the subdomain, and sends it to a PHP file which does some DB work behind the scene and redirects to the member's profile page.

The problem is that if I enable that rule, I think I am overwriting or invalidating previous rules that handle the www or non-www address. It also stops the cookies from being set properly because if you exit the page and come back again it asks you to log in again.

Any suggestions would be appreciated.

Answer 1

You'll need SSL certs that cover the subdomains if users are going to be requesting the subdomain over HTTPS - there is no other way around this without the user getting a browser warning (or failure to connect).

In order for me to try and mimic subdomains, I have the following rewrite rule which is currently disabled.

#RewriteRule ^(.*)$ http://example.com/getsub.php?membername=%1 [L,NC,QSA]

If the user is requesting the subdomain then this is a "real" subdomain, you are not "mimicking" the subdomain.

However, this directive is not complete by itself. You presumably have "some" RewriteCond directives that precede this that extract the subdomain from the requested Host header. And this is then accessed using the %1 backreference. All these directives form a single rule, so they all need to be commented out.

You are also throwing away the matched (and captured) URL-path?

This directive will also implicitly trigger an external redirect - is that the intention? Don't you want the user to remain on the subdomain? Or is the subdomain simply being used as a "short-link"?

The problem is that if I enable that rule, I think I am overwriting or invalidating previous rules that handle the www or non-www address.

Well, that rule redirects to example.com and your other directives redirect to www.example.com - so that is a conflict.

However, if you are using subdomains and the user is expected to stay on the subdomain then you can't have directives that redirect everything to the www subdomain, as you are currently doing.

This also naturally conflicts with the rule that redirects to HTTPS. You should redirect everything to HTTPS.

It also stops the cookies form being set properly because if you exit the page and come back again it asks you to log in again.

This is probably in your application logic, not Apache/.htaccess. If you have multiple subdomains and cookies should persist across all subdomains then the cookie needs to be set on the domain apex, not the requested hostname, as it sounds you might be doing.

---

If you have multiple subdomains and a preference for the www subdomain when requesting the domain apex then your directives should be rewritten something like this:

RewrietEngine On

# non-www to www (and HTTPS)
RewriteCond %{HTTP_HOST} ^(example\.com)\.?$ [NC]
RewriteRule (.*) https://www.%1/$1 [R=301,L]

# HTTP to HTTPS on the same host
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

# Remove "index.php" or "index.html" from end of URL
RewriteRule (.*)index\.(php|html?)$ /$1 [R=301,NC,L]

# Rewrite Subdomains (excluding www)
RewriteCond %{HTTP_HOST} ^((?!www\.)[^.]+)\.example\.com [NC]
RewriteRule ^ /getsub.php?membername=%1 [QSA,L]