Forum Discussion

mahnsc's avatar
mahnsc
Icon for Nimbostratus rankNimbostratus
Oct 07, 2007

http-to-https redirect with a twist

I have the basic http_to_https redirect in place on my site, so all requests to 'http://www.foo.com/*' get rewritten as 'https://www.foo.com/*' "www.foo.com" is a subscription-based, portal site. This redirect is working fine. However, our business partner has also informed us that at time of launch 15 months ago, the alias "foo.com" was also desired to be utilized for access to the site and many of our customers access the site using 'http://foo.com/*' instead of 'http://www.foo.com'.

 

 

Hitting the site using 'http://foo.com/*' results in the redirect to 'https://www.foo.com/*' as expected but not before the browser pops-up the Hostname/Certificate mismatch warning. My business partners are looking to suppress this warning. Going directly to the site using 'https://foo.com/*'

 

 

If anyone has done anything like this before and can offer me up some assistance with an existing irule or where I should be concentrating my focus, that would be super. I'm new to irules but this one seems to be a little more complex to me because of ssl. Rewriting an ssl encrypted request based upon requested URL by the end-user without the end-user knowing it also seems a bit dangerous from a security-perspective. It's ironic because the SSL Warning states that "It is possible, though unlikely, that someone may be trying to intercept your communication with this web site" because it feels to me that this is exactly what I'm trying to do.
  • mahnsc's avatar
    mahnsc
    Icon for Nimbostratus rankNimbostratus
    in the second paragraph, it should have read "Going to the site using https://foo.com/ redirects as well, but with the same pop-up hostname/certificate name mismatch warning.
  • mahnsc's avatar
    mahnsc
    Icon for Nimbostratus rankNimbostratus
    OK...now I feel silly. my http_to_https redirect is not redirecting to https://www.foo.com/ but is only replacing http in the protocol portion of the request with https.

     

     

    So, unless someone specifically asks me to re-route requests for https://foo.com/ to https://www.foo.com/, then I don't think I'll need any help with this.