One domain works with SSL but the other one doesn't?

Help
1

Thanks to Letsencrypt one domain is totally secure and running with https:// in front of it.

On the same server and the same user i can’t get a secure ssl with LetsEncrypt on another domain

The domain loads with https:// but the browser complains it’s not secure (Chromium)

And when i include the Domain Pointers on this domain they are not loading at all with https:// in front of the URL and i get a privacy warning in my browser.
The default domain is love4free.nl and the pointer is vanavondnog.nl.
In DirectAdmin at SSL Certificates the pointers are listed as secure in the section Certificate Hosts.

How can it be that one domain is fully secure with SSL and the other one with the same settings not?

2

Hi @Jello,

Both of your sites have current valid certificates, and indeed the certificate is correctly configured on vanavondnog.nl. However, that site is generating a redirect from HTTPS to HTTP at the web server level, so a secure connection is momentarily established and then the site requests visitors’ browsers to go to the insecure site instead!

You’ll have to fix this somehow in the web server configuration.

3

Hello Schoen,

In DirectAdmin the option "Use a symbolic link from private_html to public_html - allows for same data in http and https"was checked.

Now i checked the other option “Use a directory named private_html” which gives the error “403 Forbidden error” when i put https:// in front of the default domain love4free.nl.

But it’s reachable trough htpp://

When i want to change it back to symbloc link option i get the warning “Using a symbolic link will delete the private_html directory and all files in it. Do you wish to continue?”

Not sure what to do right now

4

I gave it the original settings “Use a symbolic link from private_html to public_html - allows for same data in http and https”

And it’s back to running with https:// in front of it but not secure according the browser.

When checked “Use a directory named private_html” it loads in both http and https although the latter shows a 403 error.

When checked “Use a symbolic link from private_html to public_html - allows for same data in http and https”

It doesn’t give a secure SSL connection but does load in both http and https?

5

Do you have an .htaccess file in either of your public_html directories? (These files are usually hidden, so you may need to turn on hidden files in your FTP client or use ls -a on the command line to see them.)

If so what are the contents of these files?

6

Yes i did take a look at the .htaccess file and found out that rule

“RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]” was http instead of https.

I changed it but it’s still gives a insecure connection?

Below the contents of the current .htaccess.

RewriteEngine on
RewriteBase /

RewriteCond %{HTTP_HOST} !^www.
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [R=301,L]

RewriteRule ^(.).xml sitemap.php?type=$1
RewriteRule ^dating-met-(.)_(.).html(.)$ detail.php?id=$2&name=$1&param=$3
RewriteRule ^inbox message.php?inbox=
RewriteRule ^outbox message.php?outbox=
RewriteRule ^(admin|user)($|/) - [L]
RewriteRule ^(.).htm$ page.php?page=$1
#resolve .php file for extensionless php urls
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^(.)$ $1.php [L]

Also found out that the other domain which gives a secure SSL connection is insecure after login?

7

Your insecure site errors are due to mixed content (loading insecure resources in the context of a secure page):

https://www.whynopadlock.com/results/392c8384-e517-4840-aaac-3c104d7b49fb

8

Does this means that the images served from the external domain “http://www.chatengine.nl” needs to become "httpS://www.chatengine.nl ?

9

Yes.

Since you don’t appear to be requiring HTTPS, you could also use protocol-relative URLs, e.g. //chatengine.nl so the http or https version is loaded depending on which your visitor is using.

10

Okay thanks.

Just don’t know right now how to change it so every link becomes automatically protocol-relative or simply https://

11

Do you use any kind of content management system like WordPress or Drupal or does your website use static HTML or a custom web application?

12

It’s a custom web application. It’s running in https:// but that’s not enough i see. Somehow i have to force the url’s coming from chatengine.nl and loading the images in love4free.nl to run in https://

13

In that case a simple find and replace should suffice:

find /path/to/html/or/php/files -not -path '*/\.*' -type f -exec sed -i 's/http:\/\//https:\/\//g' {} \;
14

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.