Author Topic: Redirect HTTP -> HTTPS  (Read 1474 times)

Offline jbaird

  • Contributor
  • *
  • Posts: 3
  • Karma: 0
Redirect HTTP -> HTTPS
« on: October 07, 2011, 12:01:02 PM »
My goal is simple.  I need to redirect HTTP requests to HTTPS requests.  I'm new to Netscaler, and could really use some help here.

I have tried these methods:

http://support.citrix.com/article/CTX117344
http://community.citrix.com/display/ns/Rewrite+Policy+-+Redirect+HTTP+Requests+to+HTTPS
http://www.netscalerkb.com/netscaler-tricks-and-guides/redirects-using-the-responder-module/

I tried to create a rewrite request, but when I try to apply the rewrite policy to the VS, I get an error that says "Policy cannot be bound to specified policy label."  Nothing on Google gives me any clue as to what this means.

Currently, I have a VS defined in SSL Offload -> Virtual Servers with the real IP on port 443.  I have another "dummy" virtual server created under Load Balancing -> Virtual Servers that listens on TCP/80, bound to the same IP address as HTTPS.  The "redirect" feature in the Advanced setting of this VS causes all kinds of issues.

I really just want to rewrite http:// to https://.  What is the easiest and most efficient way to do this?

Thanks for the help.


Offline asherlm

  • Contributor
  • *
  • Posts: 7
  • Karma: 4
Re: Redirect HTTP -> HTTPS
« Reply #1 on: October 07, 2011, 12:42:17 PM »
Since you didn't post an example of your rewrite rules, it's a bit hard to diagnose the bind error.
However, there are several ways to accomplish this request and below is how I've accomplished this in the past. This is a basic redirect http://mysite.com to https://mysite.com and doesn't take into account anything in the path of the request. So http://mysite.com/login.php would get redirected to https://mysite.com/. There are other ways handle that type of redirection.

My old way (easiest?).
- Create a LB vserver with the same IP on port 80 and don't bind anything as a service, then you can use the redirect (under Advanced) to the https://<url>. This would force all requests to be redirected to the SSL vserver. My problem with this method is that it leaves a nice red icon in your GUI as if something is down.

This is how I currently configure my http-https redirects for sites that are entirely SSL.
 - Create  a responder action force a redirect with the target of "https://<domain>"
 - Create a responder policy to bind that responder action with an expression of "TRUE".
 - Create a Content Switching vserver with the same IP as the SSL vserver and bind the responder policy to that vserver.

This should leave a service as enabled (nice and green) while redirecting all HTTP requests with a 302 to https://<site>

Offline jbaird

  • Contributor
  • *
  • Posts: 3
  • Karma: 0
Re: Redirect HTTP -> HTTPS
« Reply #2 on: October 07, 2011, 01:03:01 PM »
Thanks for the reply.  I actually need to redirect everything (ie, http://blah/hi to https://blah/hi).  Here is what I am trying now:

http://www.netscalerkb.com/netscaler-tricks-and-guides/redirects-using-the-responder-module/

Right now, the SSL VS is working as expected.  But, I can't even connect to the HTTP VS (It's not accepting any connections).  I have it configured on the same IP, tried using a "dummy" service and no service.  I have the responder_policy1 bound to the HTTP VS.


Offline jbaird

  • Contributor
  • *
  • Posts: 3
  • Karma: 0
Re: Redirect HTTP -> HTTPS
« Reply #3 on: October 07, 2011, 01:08:53 PM »
Ok, I made the HTTP VS a Content Switching VS - and now it accepts connections, but it's not doing anything but returning a "HTTP/1.1 Service Unavailable."  Here are the exact rules that I am using:

> add responder action responder_action1 redirect '"https://site.com" + HTTP.REQ.URL.PATH'
> add responder policy responder_policy1 'HTTP.REQ.HEADER("Host").CONTAINS.("site.com")' responder_action1
> bind cs vserver httpvsname -policy responder_policy1 -priority1

Any ideas?

Offline Paul B

  • Hero Member
  • *****
  • Posts: 193
  • Karma: 20
Re: Redirect HTTP -> HTTPS
« Reply #4 on: October 28, 2011, 09:15:15 AM »
Thanks for the reply.  I actually need to redirect everything (ie, http://blah/hi to https://blah/hi).  Here is what I am trying now:

http://www.netscalerkb.com/netscaler-tricks-and-guides/redirects-using-the-responder-module/

Right now, the SSL VS is working as expected.  But, I can't even connect to the HTTP VS (It's not accepting any connections).  I have it configured on the same IP, tried using a "dummy" service and no service.  I have the responder_policy1 bound to the HTTP VS.

Forget using the responder / rewrite features.

Just create an HTTP LBVS on the same IP as the SSL one (but on port 80). Do NOT bind any services, and force it to be "down". In the "advanced" tab, enter your FQDN in the redirect box, in the form:

"https://www.mysite.com"

(note that there is NOT a trailing "/"! )

This will take connections to http://www.mysite.com/blah, and will forward them to https://www.mysite.com/blah