Redirecting one https site to another

[Mark Holmes]

Hi,

I'm not sure if this is possible as haproxy isn't terminating SSL in this instance, but I'd like to redirect https://urlone.co.uk to https://www.urlone.co.uk

I have urlone.co.uk pointed to 185.90.33.47 via a DNS A record

bind 181.70.33.47:80
redirect location https://www.urlone.co.uk:443

bind 181.70.33.47:443
redirect location https://www.urlone.co.uk:443


www.urlone.co.uk<http://www.urlone.co.uk> is pointed to 185.90.33.48 via a DNS A record and I have a config like this:

frontend in-redirect-ssl-www.urlone.co.uk
mode http
bind 181.70.33.48:80
redirect scheme https if !{ ssl_fc }

frontend in-www.urlone.co.uk
mode tcp
bind 181.70.33.48:443
default_backend www.urlone.co.uk

backend www.urlone.co.uk
mode tcp
balance roundrobin
stick-table type ip size 200k expire 30m
stick on src
server prod-web-01 192.168.33.211:443 check port 443
server prod-web-02 192.168.33.212:443 check port 443
server Sorry_Server 192.168.33.200:80 check backup


When I hit urlone.co.uk on http I get redirected to https://www.urlone.co.uk. All good. However when I hit urlone.co.uk on https it fails with 'This site can't provide a secure connection' (jn Chrome, message is probably different in other browsers)

Is what I am trying to achieve possible? Grateful for any suggestions.

Thanks,

Mark

BI WORLDWIDE Limited | Registered in England No 01445905 | Registered address 1 Vantage Court, Newport Pagnell, Bucks, MK16 9EZ | [phone]

This e-mail message is being sent solely for use by the intended recipient(s) and may contain confidential information. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by phone or reply by e-mail, delete the original message and destroy all copies. Thank you

Please consider the environment before printing this email

[Lukas Tribus]

Hi Mark,

Hi,
I’m not sure if this is possible as haproxy isn’t terminating SSL in this instance,
but I’d like to redirect https://urlone.co.uk to https://www.urlone.co.uk
[...]
Is what I am trying to achieve possible? Grateful for any suggestions.

No. A redirect happens at HTTP level, with a HTTP response like 301 or
302. If SSL is just passing through (port 443 in tcp mode), everything
is encrypted. You cannot read HTTP request or insert HTTP responses in
this case.

If you want to redirect, you need access at HTTP level, and to have
that access, you need to terminate SSL at haproxy.



Regards,
Lukas

[Mark Holmes]

Lukas - many thanks - that confirms what I thought.

Mark


-----Original Message-----
From: ***@ltri.eu <***@ltri.eu>
Sent: 03 October 2018 23:15
To: Mark Holmes <***@eu.biworldwide.com>
Cc: haproxy <***@formilux.org>
Subject: [EXTERNAL] Re: Redirecting one https site to another

Hi Mark,

Hi,
I’m not sure if this is possible as haproxy isn’t terminating SSL in
this instance, but I’d like to redirect
https://urlone.co.uk
o.uk to
https://www.urlone.co.uk
o.uk
[...]
Is what I am trying to achieve possible? Grateful for any suggestions.

No. A redirect happens at HTTP level, with a HTTP response like 301 or 302. If SSL is just passing through (port 443 in tcp mode), everything is encrypted. You cannot read HTTP request or insert HTTP responses in this case.

If you want to redirect, you need access at HTTP level, and to have that access, you need to terminate SSL at haproxy.



Regards,
Lukas

BI WORLDWIDE Limited | Registered in England No 01445905 | Registered address 1 Vantage Court, Newport Pagnell, Bucks, MK16 9EZ | [phone]

This e-mail message is being sent solely for use by the intended recipient(s) and may contain confidential information. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by phone or reply by e-mail, delete the original message and destroy all copies. Thank you

Please consider the environment before printing this email