3

Long time lurker, first time caller...

I have a backend like admin.mysite.com which is able to use HTTPS (has a certificate installed, etc) - but that admin portal is a CMS backend for a number of client sites (ie. www.clientsite.com) that are hosted on the same servers.

Everything works well here, but the problem is when a user tries to go to https://www.clientsite.com it complains about SSL (because of the wildcard one I have installed for *.mysite.com). I would like to figure out a way to take that request and have it redirected to HTTP instead so they do not see this certificate error.

I can't do this via SSL termination, as HAProxy decrypts the request at the load balancer level and does not pass it to the backend. Which is the only way HAProxy can read HTTP headers I believe, so the client would still see an SSL error here.

My only other thought is to try a rewrite rule in Apache - but a conditional one.

So for example *.mysite.com can go SSL - but any other request that doesn't have that domain needs to be forced back to HTTP without seeing that pesky certificate warning.

Is this possible?

Improve this question
6
  • 1
    Why aren't you using SSL on your client sites? They are free now and out of beta at letsencrypt.org Also cloudflare.com offers them free if you use their zone
    – dhaupin
    Apr 22 '16 at 17:05
  • @dhaupin free SSL certs don't come with warranty assurances. No warranty is offered to the consumer, for example, should a site with their SSL be used for fraudulent activities, then the consumer has not warranty for there purchases. SSL certs are more than just a means of securing the transferring of data, its also about getting consumers to trust you.
    – Simon Hayter
    Apr 22 '16 at 20:10
  • @SimonHayter SSL certs warrant the provider of the web site, not the customer.
    – Rob
    Jun 22 '16 at 11:45
  • @Rob warranty's are are for fraudulent activities that occur because of in-accurate data of the SSL, your right that the end user doesn't have the warranty but still, its better to have, than not have... We value the end user. We believe the warranty provides peace of mind of the accuracy of the certificate information and therefore helps the merchant to sell more products. Any decent online retailer will opt to use a 'paid' service for the service agreements alone, never-mind the warranty.
    – Simon Hayter
    Jun 22 '16 at 18:21
  • @SimonHayter My only point was that your post said the consumer has a warranty available to them should something go wrong and that's not true. The web site has no obligation to cover the consumer either and it would be up to the consumer to take action against someone to get relief.
    – Rob
    Jun 22 '16 at 20:47
1

My only other thought is to try a rewrite rule in Apache - but a conditional one.
:
Is this possible?

Unfortunately not. The user sees the certificate error long before the request hits your server-side code.

The only way to fix a certificate error is to fix the certificate. If this was not the case then security could be bypassed.

the problem is when a user tries to go to https://www.clientsite.com

Although, why is the user trying to go to https://...? Are they following a link?

Improve this answer
1

I would NOT do ssl unless it is a SHA2 official CERT and unless you have control of httaccess folder redirections. Run a Google search for: "FORCING ssl via htaccess"

(Note that Google Chrome may show you an error on a CERT if it is a SHA1).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.