0

This has been asked multiple times, but none of the answers have worked for me.

I have just installed an SSL certificate and need to force https connections for all visitors.

This site has a lot of incoming links, so all existing http links should properly redirect to https.

There should be no www. There is also a rule that removes .html from files for "friendly" URLs, so that has to continue to work.

This is the old htaccess:

RewriteEngine on
RewriteCond %{HTTP_HOST} ^www.example.com [NC]
RewriteRule ^(.*)$ http://example.com/$1 [L,R=301]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([^\.]+)$ $1.html [NC,L]

What is the new set of rules I need to use?

Improve this question
4
  • Sorry but we do not allow creating another question simply because you can't find an answer that works. We have several ways of bumping questions through improving the question and answers, or running a bounty. Questions are regularly improved and new answers are left. You can also find many other force ssl related questions on Pro Webmasters, and hundreds on SO. You could ask your web hosting company as its obviously something to do with their configuration. – Simon Hayter♦ Sep 20 '15 at 14:57
  • ReWriteCond %{SERVER_PORT} !^443$ RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L] – Evgeniy Sep 20 '15 at 18:40
  • @SimonHayter This is incorrectly marked as duplicate. The question asks specifically how to combine the logic of removing www and forcing https, which your linked answer does not address. – Knocks X Sep 20 '15 at 21:02
  • I've added redirect www to non-www on the linked page, just change http://example.com/$1 to https://example.com/$1 then use any non-ssl to ssl. and ensure that they don't loop. There's several posts on Stack Overflow related questions and answers i.e stackoverflow.com/questions/19359444/… – Simon Hayter♦ Sep 20 '15 at 21:58
0

I´d suggest:

# ----------------------------------------------------------------------
# | Forcing `https://`                                                 |
# ----------------------------------------------------------------------

# Redirect from the `http://` to the `https://` version of the URL.
# https://wiki.apache.org/httpd/RewriteHTTPToHTTPS

<IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteCond %{HTTPS} !=on
   RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
</IfModule>

# ----------------------------------------------------------------------
# | Suppressing the `www.` at the beginning of URLs                    |
# ----------------------------------------------------------------------

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^ %{ENV:PROTO}://%1%{REQUEST_URI} [R=301,L]
</IfModule>
Improve this answer
4
  • 1
    You need to ensure that you always redirect to https://example.com (ie. without the www). The problem with the first directive is that if a user accessed the site via http://www.example.com and the OP doesn't have a wildcard SSL cert that covers the www subdomain then they would get an invalid certificate warning. – MrWhite Sep 20 '15 at 17:30
  • 1
    @w3d I believe that most SSL Certifactions support both non-www and www without the need of purchasing a wildcard domain. Only for sub domains other than www do you need to purchase a wildcard or individual cert, or at least the ones I buy do... – Simon Hayter♦ Sep 20 '15 at 20:10
  • @SimonHayter Admittedly a true "wildcard" subdomain cert is unnecessary, it just needs to support both. However, questions keep cropping up where one or the other isn't supported, such as this one from the other week, "unable to support SSL on my www subdomain". – MrWhite Sep 20 '15 at 22:34
  • We have a wildcard cert but if you have www.sub.domain.com then we get the invalid cert warning. This is pretty standard for wildcard certs. So, any way to modify your answer to account for this? – Works for a Living Mar 27 '16 at 20:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.