6

I'd like my website to be SSL only but I'm faced with problem regarding the SSL certification not being supported on older browsers such as IE8, not that I care to much but wondering if there's away around the issue using the htaccess, virtual host, or maybe even php.

My current redirect looks like this (please note that the server uses port 8080 and one of the reasons its using a request_scheme:

RewriteEngine on
RewriteCond %{REQUEST_SCHEME} =http
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

It there away to only redirect SNI supported browsers using htaccess or similar?

  • 3
    Detect user agents?! – MrWhite May 31 '15 at 10:33
  • Would that work reliably in the htaccess? – Simon Hayter May 31 '15 at 12:01
  • 1
    As per serverfault.com/questions/389806/… user agent sniffing would be the only way to go about it. Not sure why sniffing the user agent in .htaccess would be unreliable. – nathangiesbrecht Jun 1 '15 at 16:20
  • 4
    The only "problem" I see is that this appears to be a site-wide redirect to HTTPS, so presumably only the HTTPS version of the site is indexed? If a user with an unsupported user-agent navigates directly to the HTTPS version (eg. from SERPs) then they are going to be hit with a security cert warning - I don't think there is any way round that scenario. This StackOverflow question also provides more insight (they specifcally make sure that the HTTP version is indexed and only use HTTPS for checkout). – MrWhite Jun 1 '15 at 16:38
  • That's a very good point, I hadn't considered that situation. – nathangiesbrecht Jun 1 '15 at 17:13
4

Well first of all SNI is a server setting not a cert setting.

A bit of background here might help:

When a browser connects to a https website, it converts the website name to an IP address and then initiates a SSL connection to that IP address (without the address name) and checks the cert returned by the server. Then it sends encrypted web requests (including the address name this time) using that cert.

The problem is when lots of sites are hosted on the same IP address (as increasingly happens due to the fact we're running out of IPv4 IP addresses), then the initial SSL connection doesn't know which site you want to connect to, as that initial connection only has the IP address and not the website name, so it sends back the default cert which, if it doesn't match the website name you are asking for, causes a cert error to be returned to the user.

SNI (Server Name Indication) is an extension to the SSL request to also include the server name in that initial connection and hence the correct cert can be returned and the SSL connection can be established correctly.

However older browsers (and particularly IE8 on XP as the main non-SNI browser still being used despite XP's end of life status), do not support SNI.

Anyway back to your question. It appears your site is hosted by gandi.net as well as them providing your cert. It also appears they do not provide you with a unique IP address and hence you need to use SNI if you want to have a https site.

There are a few workarounds:

  1. Gandi could provide a master cert which includes your hostname and use this as the default cert on that IP address. They are unlikely to agree to this and, even if they did it doesn't look very professional to have a cert shared by multiple different, unrelated companies. Not to mention the fact you would be sharing the cert key with others. This is only really an option if you are in full control of the server and hosting several related sites, all under your control, on the same server.
  2. You could just not support old browsers. Only you can judge the impact of such a decision. XP users can still use a different browser - just not IE8. But whether they realise that is a valid point.
  3. You could ask gandi if you can upgrade to a dedicated IP address account if they do that. Will presumably cost more than your currently paying.
  4. You could move your site to another hosting company which provides dedicated IP addresses. Again there will be cost and time implications of this.
  5. You could just stick with http only.
  6. You could have a mixed site (http and https on same site) and only support https for some browsers as you are asking for.

Looking at the last option in more detail, the only way to do this is to use http by default and redirect certain users to https based on browser sniffing - as others have suggested. However there are several issues with this:

  1. This will only work properly if you catch all the browser agents that don't support SNI which is not a trivial task. Alternatively you could concentrate on just the main ones you might care about (e.g. only support this workaround for XP/IE8).
  2. This will not work in reverse - you cannot redirect a https call to http as the SSL negotiation is the first thing that happens, before the content (i.e. the redirect message) is sent. So if a non-SNI user clicks on a https link then they will get an error.
  3. Search engines might not crawl site correctly (apparently Bing has only started supporting SNI recently and only partially: Bing and lack of SNI support).
  4. Mixed sites are BAD for a number of reasons: confusing, difficult to administer, easier to accidentally include mixed content leading to browser alerts for the user, expose sensitive cookies in plaintext when viewing http pages, allow MITM attacks which can intercept requests to prevent upgrade to https, make SEO more difficult...etc. I would strongly encourage https everywhere (even as far as using HSTS header) rather than a mixed site.

Although not directly answering your question, hopefully that gives you more detail to help you decide if you really should do what your asking to do.

  • 1
    Yep, indeed. My hosting uses Vanish which doesn't use a dedicated IP, its extremely fast, but ya the IP is shared which sucks. I could move to the VPS which I would get a dedicated IP but then again, I don't know how much I care for IE8, I rarely ever see IE8 user agent on my server logs in any case, and to be honest lol, As a website designer I wouldn't want to work with anyone using IE8 anyway. – Simon Hayter Jun 4 '15 at 22:37
0

This is actually a more common requirement than you might think. Since IE8 is the latest browser available to Windows XP users, currently 14.79% of users globally are still using IE8, according to NetMarketShare.com.

You can setup an .htaccess rule so that if the web browser (according to the User-Agent header, see List of IE8 User-Agent strings) is IE8 then even if they click on an HTTPS link in the search engine, the user is server-side redirected to a non-SSL version of your website before they ever load a page with an associated SSL certificate.

RewriteEngine on

# If web browser is IE8 then redirect to non-SSL version of website
RewriteCond %{HTTP_USER_AGENT} "MSIE 8.0" [OR]
RewriteCond %{HTTP_USER_AGENT} "OptimizedIE8"
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# Otherwise, if user trying to access non-SSL version, redirect them to SSL version
RewriteCond %{REQUEST_SCHEME} =http
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
  • It's a shame you can't filter through those results without being an upgrade by GEO or about the actual person. This may be stereo typing on my part but I suspect a large portion of those users are: old, in a poorer country, or work in a government sector. – Simon Hayter Jun 2 '15 at 11:32
  • Actually many people still use Windows XP simply because it still works fine for their purposes and with not using the PC for anything high-risk data wise, for example home users just browsing or checking personal email (mostly spam or commercial newsletters etc) provided its not a really old machine that crawls along super slow, it just does the job. Also a lot of people bought reasonable spec Vista PC's that were downgraded to XP and so benefit from pretty decent performance. Most personal users aren't fussed about upgrading because they want the windows security updates, normally for speed. – richhallstoke Jun 2 '15 at 12:26
  • I beg to differ because Microsoft stopped supporting Windows XP over year ago and because of that there are many unpatched security loop holes. Most if not all government sectors here in the UK etc, NHS upgraded to Windows 7 as soon as it was announced. I stand by what I said, I believe those percentages now come from countrys that you generally wouldn't target as a US or UK webmaster, for example the China has the highest population in the world and according to stat counter the highest population in the world to still using XP. – Simon Hayter Jun 2 '15 at 13:40
  • See > kaspersky.com/about/news/virus/2014/… that is as of last year and before they MS stopped supporting XP. It will be under 1% easily now for people in the US. Thats 1/100 users, not 1/10 according to the list you shared :) NetMarketShare is pretty much useless, or until you pay a monthly fee to filter through AGE, Gender, Location and so forth. – Simon Hayter Jun 2 '15 at 13:41
  • 3
    This answer won't work at all. The SSL negotiation happens BEFORE the request is submitted and therefore processed as a redirect. – Barry Pollard Jun 3 '15 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.