0

Bit of a strange one, but here goes:

I have created a new vhost for website1.com an uplaoded files in var/www/html/website1.com. The site previously had an SSL on the previous server.

On the new server SSL has not been setup yet.

When accessing the site on the new server, obviously all urls are "https" still.

The site will then redirect to a completely different url website2.com (which has an active SSL installed).

Is there a way of disabling this, and just show the normal SSL / https error?

(please correct me if i haven't used the correct terms)

  • "On the new server SSL has not been setup yet." "When accessing the site on the new server, obviously all urls are "https" still.". No. If SSL isn't setup, you can't access HTTPS. You'd have to access HTTP. – earthmeLon Apr 14 '18 at 19:28
0

This situation occurs frequently.

Here's why + how to clear it up.

1) On your website1 with SSL. If you set the HSTS flag, using something like...

Header always set Strict-Transport-Security "max-age=63072000; preload"

Then your browser will cache this header for whatever your max-age setting was. This value is usually 1-2+ years.

2) You setup a new website1 without SSL.

Your browser cache still contains the HSTS header.

Note: When I say browser cache, this is not your browser's file cache (usually). This all depends on what browser you're using. There's no standard of how browser's cache these headers, just how long.

3) Now whenever you visit website1, your browser requires that site to by SSL, as it was before + an HSTS header is cached.

4) This will continue to fail until you take one of two actions.

This will continue to fail because your browser will forever force accessing website1 via HTTPS + never HTTP.

a) You figure out how to flush the HSTS header out of your browser.

b) You move your original SSL cert to your new website1 site.

Moving your original SSL cert to your new site is best option, because every visitor that visited your site when their was an SSL cert + HSTS header will have the exact same error as you have.

So even if you fix this for yourself, anyone who previously visited your site, will get an error for max-age time... so 1-2+ years, they won't be able to visit your site.

https://LetsEncrypt.org has been providing free + strong SSL certs for years. With my hosting clients, I setup SSL for every site. Period. Even if all that site does, is redirect to another site.

Fix SSL on website1 + likely all will be well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.