Using .htaccess to redirect http://, http://www., and https://www. to https://

问题

It looks like various permutations of this question have been asked before, but it looks like all of the answers have specific idiosyncrasies that don't apply to my situation, or just don't work.

So, here's what I'm after...

I would like these three URLs:

http://example.com
http://www.example.com
https://www.example.com

... To all redirect to:

https://example.com

From another answer, I tried this;

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]

    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

But, that doesn't redirect from https://www.example.com to https://example.com

So, the result is a certificate warning (since my certificate is only valid for example.com, not www.example.com).

I also tried this (from https://html5boilerplate.com/)...

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} !=on
    RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^ %{ENV:PROTO}://%1%{REQUEST_URI} [R=301,L]
</IfModule>

... But that didn't work either:

http://www.example.com was redirected to https://www.example.com
https://www.example.com was not redirected

Thanks in advance for your help.

回答1:

Try:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\.
RewriteRule ^ https://example.com%{REQUEST_URI} [L,R=301]

This uses the OR condition flag such that the redirect happens when either it isn't https or if the host starts with "www".

Something else that's worth noting here:

since my certificate is only valid for example.com, not www.example.com

The SSL handshake happens before the HTTP request is sent. That means mod_rewrite or htaccess isn't even part of the equation when you request https://www.example.com/, the browser will see the cert and immediately flag it as a security exception. Nothing you can do about that except buy a new cert.

回答2:

You cannot do that.

HTTPS is an outer wrapper (transport layer, as name implies). First HTTPS layer should be working (and certificate issues rectified) before the server gets request headers, can determine HTTP 1.1 host, and can send a Location header along.

For that to work, you would either need a "wildcard certificate" that is valid for both example.com and www.example.com, or two different certificates for the mentioned hosts, one paid for only to provide redirect.

This is hard to accept but this is how it works.

It would be neat if CAs would finally accept that www.domain and domain should go with a single - if somewhat, but not twice or more expensive - certificate.

来源：https://stackoverflow.com/questions/33268353/using-htaccess-to-redirect-http-http-www-and-https-www-to-https

标签

.htaccess

mod-rewrite

redirect