Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

HTTPS Links for Sites Without AutoSSL Redirecting to Site With AutoSSL?

Discussion in 'Security' started by linux4me2, Sep 19, 2016.

Tags:
  1. linux4me2

    linux4me2 Well-Known Member

    Joined:
    Aug 21, 2015
    Messages:
    219
    Likes Received:
    55
    Trophy Points:
    28
    Location:
    USA
    cPanel Access Level:
    Root Administrator
    I have one site, call it domainwithAutoSSL.com, on a shared IP address set up with AutoSSL. HTTPS is working just fine on that site. None of the other sites on that shared IP address have AutoSSL.

    DomainwithAutoSSL.com happens to be a WordPress test site, and I was testing WordFence on it. I noticed that in WordFence's Live Traffic, other sites on the server that share the same IP address were showing up in the logs. All the URLs were HTTPS URLs that various search 'bots were testing.

    If I try to browse to one of the HTTPS URLs that's erroneously showing up in the Live Traffic logs, I'm not redirected to domainwithAutoSSL.com. I'm taken to the correct domain and see the expected "Your connection is not secure" message from Firefox, so redirect issues don't seem to be the problem.

    I found this post on WordFence's support site, which suggested the problem was with the virtual hosts on my managed VPS. I contacted my web host, and they say that there is no problem with the virtual host setup. They think the issue is with AutoSSL, and suggested I activate AutoSSL on all the sites on that IP, or just use it on domains that have dedicated IP addresses.

    Now, it's my impression from reading the docs that AutoSSL should work just fine on a shared IP address, and redirects from non-AutoSSL sites using HTTPS URLs would not be an issue. Is there something I'm missing?
     
    #1 linux4me2, Sep 19, 2016
  2. linux4me2

    linux4me2 Well-Known Member

    Joined:
    Aug 21, 2015
    Messages:
    219
    Likes Received:
    55
    Trophy Points:
    28
    Location:
    USA
    cPanel Access Level:
    Root Administrator
    I take it back, if I go to one of the non-AutoSSL sites and bypass the security warning, I am taken to domainwithAutoSSL.com, so it appears you have to either be using a dedicated IP address or have to enable AutoSSL for all the sites on a shared IP. Bummer.

    So is that the way it's supposed to work, or is something broken?
     
    #2 linux4me2, Sep 19, 2016
  3. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,200
    Likes Received:
    1,936
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #3 cPanelMichael, Sep 22, 2016
  4. linux4me

    linux4me Member

    Joined:
    Jul 14, 2007
    Messages:
    20
    Likes Received:
    1
    Trophy Points:
    53
    Thank you, Michael.

    So if you want to use AutoSSL on a shared IP and avoid HTTPS URLs for unsecured sites from redirecting to a secured site on that IP, you need to either:
    1. Make sure all domains and subdomains on the shared IP have valid AutoSSL certificates.
    2. Follow the instructions in the document article you linked to above. (Which looks to my inexperienced eyes like it won't work if each domain on the shared IP has its own AutoSSL cert because the code snippet points to a single certificate.)
    It seems to me that if I have a spare IP address on the server, the best thing to do is to move all the sites I want to secure with SSL to that IP address, or to continue to use a dedicated IP for each SSL site as I did before AutoSSL?
     
    #4 linux4me, Sep 23, 2016
  5. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,200
    Likes Received:
    1,936
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello,

    Yes, this is the best course of action if changing an account's IP address is a viable option on your server. Otherwise, like you mentioned, you would need to ensure each domain name uses it's own SSL certificate.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #5 cPanelMichael, Sep 23, 2016
    linux4me2 likes this.
  6. linux4me

    linux4me Member

    Joined:
    Jul 14, 2007
    Messages:
    20
    Likes Received:
    1
    Trophy Points:
    53
    I'm afraid I'm overlooking something. Why wouldn't changing an account's IP address be a viable option if I have an extra IP I can use just for AutoSSL domains?
     
    #6 linux4me, Sep 23, 2016
  7. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,200
    Likes Received:
    1,936
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello,

    It is in-fact an option you can use to address the issue. In some cases, administrators do not have access to more than one IP address on the server.

    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #7 cPanelMichael, Sep 26, 2016
    linux4me2 likes this.
(You must log in or sign up to post here.)
Loading...
Similar Threads - HTTPS Links Sites
  1. sksanthosh17

    Redirect webmail to https

    sksanthosh17, Oct 23, 2018, in forum: General Discussion
    Replies:
    1
    Views:
    81
    cPanelLauren
    Oct 25, 2018
  2. durangod

    https supported protocol

    durangod, Oct 19, 2018, in forum: Security
    Replies:
    1
    Views:
    68
    cPanelLauren
    Oct 23, 2018
  3. techturch

    Proxy subdomain redirection to https?

    techturch, Sep 21, 2018, in forum: Security
    Replies:
    1
    Views:
    144
    cPanelLauren
    Sep 21, 2018
  4. MajorLancelot

    SOLVED [CPANEL-22603] HTTPS Redirect Odd Behavior

    MajorLancelot, Aug 30, 2018, in forum: General Discussion
    Replies:
    5
    Views:
    290
    cPanelLauren
    Nov 9, 2018
  5. Rogerio

    Correct way to redirect HTTP to HTTPS?

    Rogerio, Jul 26, 2018, in forum: Security
    Replies:
    8
    Views:
    468
    cPanelLauren
    Aug 8, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice