How do I redirect HTTP to HTTPS?

Short answer

The easiest way is to add a frontend row with Protocol = HTTP → HTTPS for port 80 to the HTTP vService; the HTTPS row stays with the Encrypted (HTTPS) protocol and the certificate. Requests coming to 80 are redirected with the 301 code to the https:// address of the same Host and path; this code cannot be changed. If another code such as 307/308 or the redirection of only specific paths is needed, the Redirect to HTTPS action is used with the If SSL is NOT terminated condition; if another target address or a port other than 443 is needed, the Location Redirection action is used. Redirection can be done only on the HTTP vService.

Problem: Users Access the Site over Unencrypted HTTP

Users can reach the site unencrypted by typing http:// in the address bar or from old links. This traffic can be read on the way; session cookies and form data can be exposed. Requests coming to port 80 need to be redirected to HTTPS automatically.

Solution: Four Methods

The methods are alternatives to each other; only one is used for the same request.

Your situation	Suitable method
Sending all HTTP traffic to the HTTPS version of the same address	Method 1: HTTP → HTTPS in the Frontend row
Redirection with the 307/308 code or only for specific paths	Method 2: Redirect to HTTPS action
Redirecting to another domain name or to an HTTPS port other than 443	Method 3: Location redirection action
From the command line	Method 4: WEB-CLI

Method 1: HTTP → HTTPS in the Frontend Row Recommended

• How it works The row added for port 80 redirects every request coming unencrypted with the 301 code to the https:// address of the same Host and path (the query string is preserved). It does not touch HTTPS requests; no loop occurs.
• Where it is opened vService edit form → Frontend → Protocol → Redirect group → HTTP → HTTPS
• Requirement HTTP vService; a row with the Encrypted (HTTPS) protocol and a certificate on port 443
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the certificate add form (if needed)

If the certificate to be used in the HTTPS row does not exist on TR7, Add is clicked on the Certificates & PKI → SSL/TLS Certificates screen (how to add).

2

Adım 2 Define the certificate (if needed)

The Certificate Name is entered; for separate PEM files, Type = Manual is selected and Certificate Content and Key Content are entered; for a PKCS#12 file, Type = PFX is selected and the file and its password are entered (How do I upload my certificate to TR7; which formats are supported?).

3

Adım 3 Save the certificate (if needed)

Add at the bottom of the form is clicked; the certificate is added to the list.

4

Adım 4 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

5

Adım 5 Define the HTTPS row

In the HTTPS row in the Frontend list, Port = 443 and Protocol = HTTP/2 (or HTTP/1.1) from the Encrypted (HTTPS) group are selected. The certificate is selected in the Certificate field that appears when an encrypted row is selected; if no certificate is selected, the row listens unencrypted.

6

Adım 6 Add the redirect row

A new row is added with the + icon in the header of the Frontend table: Frontend IP = the address in the HTTPS row, Port = 80, Protocol = HTTP → HTTPS in the Redirect group (typical configuration). If there is already a row with the HTTP protocol on port 80, no new row is added; the Protocol value of that row is changed.

7

Adım 7 Save

Save is clicked; the redirection is applied without a separate deployment step. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1RedirectClient side

The unencrypted address is queried; then it is checked that the HTTPS address does not return a redirect.

Command: curl -sI "http://www.example.com/yol?x=1" · curl -sI https://www.example.com/

Expected301 · Location: https://www.example.com/yol?x=1 · HTTPS: 200

If the HTTPS request also returns 301, there is a loop: there is an unconditional redirect action on the same vService.

Method 2: Redirect to HTTPS Action

• How it works The action redirects the requests that match the condition with the selected code to the https:// address of the same Host and path. Since it does not separate HTTPS requests by itself, it is used with the predefined If SSL is NOT terminated condition.
• Where it is openedLoad Balancer → Actions → Action Type = Redirect to HTTPS
• Requirement A frontend row with Protocol = HTTP on port 80 and an HTTPS row on the HTTP vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Path condition form (if needed)

If only specific paths are to be redirected, Add is clicked on the Load Balancer → Conditions screen (how to add). If all HTTP traffic is to be redirected, steps 1–3 are skipped.

2

Adım 2 Define the Path condition (if needed)

Criteria = Path is selected and the path to be redirected is written (e.g. requests starting with /login).

3

Adım 3 Save the Path condition (if needed)

Add is clicked; the condition is added to the list.

4

Adım 4 Open the action form

On the Load Balancer → Actions screen, Add is clicked (how to add).

5

Adım 5 Define the action

The Action Name is entered; Action Type = Redirect to HTTPS is selected. Redirect Scheme Code is 301 by default; if the method of POST requests is to be preserved, 307 or 308 is selected. The list contains the whole 300–308 range; however, only 301, 302, 303, 307 and 308 are redirect codes. In the Conditions field, the predefined If SSL is NOT terminated condition is selected; if the Path condition from step 2 is also to be used, it is added to the same group with and.

6

Adım 6 Save the action

Add is clicked; the action is added to the list.

7

Adım 7 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

8

Adım 8 Check the unencrypted row

In the Frontend list, the Protocol value of the row with port 80 must be HTTP. The action is processed before the redirection in the row; however, if HTTP → HTTPS remains selected in the row, the unencrypted requests that do not match the condition of the action are also redirected with 301. If there is no such row, it is added with the + icon in the header of the Frontend table.

9

Adım 9 Add the action to the vService

In the Details panel, the Actions box under Modules is checked and the action is selected in the field that opens. Actions are processed in the order in the list; the actions after the one that redirects the request do not run.

10

Adım 10 Save

Save is clicked. Unless the action is added to the vService, it does not run. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1RedirectClient side

The unencrypted address is queried; then it is checked that the HTTPS address does not return a redirect.

Command: curl -sI "http://www.example.com/login?x=1" · curl -sI https://www.example.com/login

ExpectedThe selected code (e.g. 308) · Location: https://www.example.com/login?x=1 · HTTPS: 200

2Action HitsTR7 side

If Hit Counter is on in the action, the Action Hits tab on the vService Dashboard is checked.

ExpectedThe action's counter increases

Method 3: Location Redirection Action

• How it works The request is redirected to the address written in the Redirect Location field; the address is built with fixed text and Smart Variables. It is used for redirecting to another domain name or to a port other than 443 such as https://www.example.com:8443.
• Where it is openedLoad Balancer → Actions → Action Type = Location Redirection
• Requirement A frontend row on port 80 on the HTTP vService; the action does not run without a condition
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action form

On the Load Balancer → Actions screen, Add is clicked (how to add).

2

Adım 2 Write the target

The Action Name is entered; Action Type = Location Redirection is selected. The target starting with https:// is written in the Redirect Location field (e.g. https://www.example.com:8443), and the path and query string of the request are preserved by adding the %PATHQ (Path + query of the request) variable with the fx button of the field. Redirect Code is 301 by default.

3

Adım 3 Select the condition

In the Conditions field, the predefined If SSL is NOT terminated condition is selected. This action requires a condition: if it is saved without a condition being selected, the interface gives no warning, but the action never runs.

4

Adım 4 Save the action

Add is clicked; the action is added to the list.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked. There must be a frontend row on port 80; the Protocol value of the row can be HTTP or HTTP → HTTPS, and the action is processed before the redirection in the row.

6

Adım 6 Add the action to the vService

In the Details panel, the Actions box under Modules is checked and the action is selected in the field that opens.

7

Adım 7 Save

Save is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1RedirectClient side

The unencrypted address is queried.

Command: curl -sI "http://www.example.com/yol?x=1"

Expected301 · Location: https://www.example.com:8443/yol?x=1

Method 4: WEB-CLI

• How it works The redirect row is added to the frontend list of the vService from the command line; --listen.N.ssl redirect is the HTTP → HTTPS option in the interface.
• Where it is opened TR7 WEB-CLI → lb service update
• Requirement WEB-CLI access; an HTTPS row with a certificate on port 443 on the vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 View the existing frontend rows

The vService record is displayed (lb service):

lb service show <vService>

The listen.0, listen.1 … lines in the output are the frontend rows; the HTTPS row and the address it uses are read from here.

2

Adım 2 Add the redirect row to the first empty position

--listen.N changes the fields of the existing row at that position; for this reason, the new row is written to the first empty position. If the vService has only the HTTPS row (listen.0), the position is 1:

lb service update id <vService> --listen.1.ip <address> --listen.1.port 80 --listen.1.ssl redirect

The address is written in the format listed with the Tab key (e.g. 203.0.113.10/24).

Verification

1RecordTR7 side

The vService record is displayed again.

Command: lb service show <vService>

Expectedlisten.1.port 80 · listen.1.ssl redirect

On the client side, the curl check in Method 1 gives the same result.

Common Mistakes

• Adding the Redirect to HTTPS action without a condition. HTTPS requests are also redirected and an infinite loop occurs; the If SSL is NOT terminated condition is selected.
• Leaving HTTP → HTTPS in the 80 row while wanting to redirect only specific paths. The action is processed before the redirection in the row and applies its own code to the requests that match its condition; however, all the unencrypted requests that do not match the condition are also redirected with 301 by the row. If only the selected paths are to be redirected, the Protocol value of the 80 row is set to HTTP.
• Using 301 for API clients. In 301 and 302 redirection, clients can turn a POST request into GET; for the method to be preserved, 307 or 308 is selected with the action.
• Keeping the HTTPS row on a port other than 443 and using HTTP → HTTPS. The port is not included in the redirect address; the browser goes to 443. For a port other than 443, the Location redirection action is used.
• Thinking that the redirection fixes mixed content. The http:// resources in the page are fixed separately (After switching to HTTPS, pages show a "mixed content" warning; how do I fix it?).
• Looking for redirection on the L7 TCP vService. The HTTP → HTTPS option and the redirect actions exist only on the HTTP vService.

How it is done in the documentation

• HTTP (L7) vService · Protocol
• HTTP (L7) vService · Typical configuration: 80 → 443 redirect + HTTP/2
• Redirect to HTTPS · Redirect Scheme Code
• Location Redirection · Redirect Location

Related questions

• How do I add HSTS?
• After switching to HTTPS, pages show a "mixed content" warning; how do I fix it?
• Can the same vService listen on both port 80 and port 443?