/ Register

Learn about Centmin Mod LEMP Stack today
Register Now

SSL How to remove SSL 301 permanent redirect ?

Discussion in 'Domains, DNS, Email & SSL Certificates' started by eva2000, Mar 4, 2015.

Tags:
Previous Thread Next Thread
Loading...
Page 2 of 2
  1. Jun 5, 2015 #21
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    9:34 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    max-age set when HSTS enabled ?
     
  2. Jun 5, 2015 #22
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    7:34 PM
    Mainline
    10.2
    Yes, 6 months as maximum on Cloudflare.
     
  3. Jun 5, 2015 #23
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    9:34 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Did you at all clear browser caches/reboot system on your end between switching on/off HSTS and https ? That would of cleared it for you but maybe not visitors.
     
  4. Jun 5, 2015 #24
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    7:34 PM
    Mainline
    10.2
    No I didn't clear browser cache (Intended to test as if I'm normal user/visitor).
    I have open 3 browser's to test if it will not messed up things between switching.
    I even test it on my phone 3 browser before and after still without clearing browser cache.
     
  5. Jun 5, 2015 #25
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    9:34 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Also you using Cloudflare full strict SSL or free flexible SSL ? The HSTS issue only applies to free/flexible SSL as it uses Cloudflare's own internal CA certificate so it's untrusted in visitors browsers. Whereas Full Strict presents visitors with your origin's SSL cert CA for checking
    strange then.. could mean HSTS ain't working right on Cloudflare
     
  6. Jun 5, 2015 #26
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    7:34 PM
    Mainline
    10.2
    Full SSL.
     
  7. Jun 5, 2015 #27
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    9:34 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    you have to wonder if HSTS is working on Cloudflare then as it's not meant to do that - browser should see HSTS and max-age and respect if for max-age time Enforce Web Policy with HTTP Strict Transport Security (HSTS)

     
  8. Jun 5, 2015 #28
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    9:34 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    ooh found that Chrome can delete HSTS cache/domains via chrome://net-internals/#hsts and Opera opera://net-internals/#hsts

    upload_2015-6-5_18-20-12.png
     
  9. Jun 5, 2015 #29
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    7:34 PM
    Mainline
    10.2
    Maybe you forgot, I have HTTPS still open, not redirected back to HTTP :)
    Just HTTP as my forum default URL now, and HTTPS is still open for those who want.
     
  10. Jun 5, 2015 #30
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    9:34 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    ah maybe why
     
  11. Jun 5, 2015 #31
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    7:34 PM
    Mainline
    10.2
    And to add, when I try to forced to redirected back all request to HTTP only with 301 on my nginx config.
    All browser's still works but Chrome has redirect loop, not sure if it's a problem or my browser still cache cloudflare old HSTS ( I don't want to clear any cache to simulate normal visitors :D).
    So in order to fix something like that I open up HTTPS and leave it as option :)
    Don't have any complains until now :).
     
  12. Jun 5, 2015 #32
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    9:34 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    yeah leaving HTTPS accessible but without forced redirect to HTTPS is a nice work around
     
  13. Jun 5, 2015 #33
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    7:34 PM
    Mainline
    10.2
    :D
     
  14. Jul 15, 2015 #34
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    7:34 PM
    Mainline
    10.2
  15. Jul 15, 2015 #35
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    9:34 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    guess they're still no ready over at Google ?
     
  16. Jul 15, 2015 #36
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    7:34 PM
    Mainline
    10.2
    Looks like.
    RPM and CPC drop a lot after switching to HTTPS.
     
  17. Sep 19, 2015 #37
    Chris

    Chris Member

    51
    10
    8
    Feb 27, 2015
    Ratings:
    +15
    Local Time:
    7:34 AM
    1.7
    10
    Just wanted to follow up...a lot of ads break my SSL...and don't display which is incredibly sad.
    I like the idea of forcing http, and allowing https, have you seen any backlash?
     
Previous Thread Next Thread
Loading...
Page 2 of 2

.