# Force http to https

**URL:** <https://discourse.haproxy.org/t/force-http-to-https/1300>\
**Category:** Help!\
**Created:** [June 9, 2017, 4:44am UTC](https://discourse.haproxy.org/t/force-http-to-https/1300 "2017-06-09T04:44:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![zahid.k11](https://avatars.discourse-cdn.com/v4/letter/z/50afbb/32.png) [@zahid.k11](https://discourse.haproxy.org/u/zahid.k11)\
**Post date:** [June 9, 2017, 4:44am UTC](https://discourse.haproxy.org/t/force-http-to-https/1300/1 "2017-06-09T04:44:17Z")

</div>

Hi Team,

I’m trying to force https on my test website. I have the following config “haproxy \> Nginx \> Tomcat”. However whenever I add “redirect scheme https if !{ ssl\_fc }” to force https my login stops. Currently, both http and https are working well individually. The following is my configuration. I have separate frontend & backend for http and https. Not sure where I am going wrong. Please help!!

frontend http-test-80  
bind 192.168.1.10:80  
mode http  
reqadd X-Forwarded-Proto:\ http

```
    redirect scheme https if !{ ssl_fc }

    acl host_test80 hdr(host) -i test.zahid.com
    use_backend static_test if host_test80

    acl host_test80 hdr(host) -i static1.test.zahid.com
    use_backend static_test if host_test80

```

backend static\_test  
balance roundrobin  
option httpclose  
option forwardfor  
cookie static insert indirect nocache  
option httpchk HEAD /LoadBalancer\_HealthCheck.php HTTP/1.0  
server stat-test 192.168.1.20:80 cookie mpstatic1 check

=================================================================================  
frontend http-test-443  
bind 192.168.1.10:443 ssl crt /etc/haproxy/certs/test.zahid.com/test.zahid.com.pem  
reqadd X-Forwarded-Proto:\ https

```
    acl host_test443_secure hdr(host) -i test.zahid.com
    use_backend static_test_secure if host_test443_secure

    acl host_test443_secure hdr(host) -i static1.test.zahid.com
    use_backend static_test_secure if host_test443_secure

```

backend static\_test\_secure  
balance roundrobin  
option httpclose  
option forwardfor  
redirect scheme https if !{ ssl\_fc }  
cookie static insert indirect nocache  
option httpchk HEAD /LoadBalancer\_HealthCheck.php HTTP/1.0  
server stat-test-secure 192.168.1.20:80 cookie mpstatic2 check

Best Regards,  
Zahid

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [June 9, 2017, 7:28am UTC](https://discourse.haproxy.org/t/force-http-to-https/1300/2 "2017-06-09T07:28:53Z")

</div>

Do you have multiple backend servers or is there just one, as per the configuration you provided?

I suggest you use the same backend for both frontends. Especially the fact the same server has a different cookie value is problematic.

---

<div class="post-metadata">

**Author:** ![zahid.k11](https://avatars.discourse-cdn.com/v4/letter/z/50afbb/32.png) [@zahid.k11](https://discourse.haproxy.org/u/zahid.k11)\
**Post date:** [June 9, 2017, 10:18am UTC](https://discourse.haproxy.org/t/force-http-to-https/1300/3 "2017-06-09T10:18:09Z")

</div>

Hi lukastribus,

Thanks for your reply!!

No just one backend server (nginx).

Okay so if I use same backend for both frontends then should my config look like the following. Please correct me if any config mistakes:

frontend http-test-80  
bind 192.168.1.10:80  
mode http  
reqadd X-Forwarded-Proto:\ http

```
redirect scheme https if !{ ssl_fc }

acl host_test80 hdr(host) -i test.zahid.com
use_backend static_test_secure if host_test80

acl host_test80 hdr(host) -i static1.test.zahid.com
use_backend static_test_secure if host_test80

```

=================================================================================

frontend http-test-443  
bind 192.168.1.10:443 ssl crt /etc/haproxy/certs/test.zahid.com/test.zahid.com.pem  
reqadd X-Forwarded-Proto:\ https

```
acl host_test443_secure hdr(host) -i test.zahid.com
use_backend static_test_secure if host_test443_secure

acl host_test443_secure hdr(host) -i static1.test.zahid.com
use_backend static_test_secure if host_test443_secure

```

backend static\_test\_secure  
balance roundrobin  
option httpclose  
option forwardfor  
redirect scheme https if !{ ssl\_fc }  
cookie static insert indirect nocache  
option httpchk HEAD /LoadBalancer\_HealthCheck.php HTTP/1.0  
server stat-test-secure 192.168.1.20:80 cookie mpstatic1 check

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [June 9, 2017, 10:41am UTC](https://discourse.haproxy.org/t/force-http-to-https/1300/4 "2017-06-09T10:41:29Z")

</div>

Then why do you configure roundrobin, heatlh checks and cookie stickiness? That makes no sense with only one backend server.

> [@zahid.k11](#):
>
> my login stops.

Elaborate what that means exactly please.

---

<div class="post-metadata">

**Author:** ![zahid.k11](https://avatars.discourse-cdn.com/v4/letter/z/50afbb/32.png) [@zahid.k11](https://discourse.haproxy.org/u/zahid.k11)\
**Post date:** [June 9, 2017, 1:11pm UTC](https://discourse.haproxy.org/t/force-http-to-https/1300/5 "2017-06-09T13:11:03Z")

</div>

Hi lukastribus,

Actually, earlier I was using two servers in backend and hence the settings you’ve pointed out but now i’ve decided to continue with only one backend server and I haven’t disturbed the earlier settings.

Best Regards,  
Zahid

---

<div class="post-metadata">

**Author:** ![zahid.k11](https://avatars.discourse-cdn.com/v4/letter/z/50afbb/32.png) [@zahid.k11](https://discourse.haproxy.org/u/zahid.k11)\
**Post date:** [June 11, 2017, 11:43am UTC](https://discourse.haproxy.org/t/force-http-to-https/1300/6 "2017-06-11T11:43:19Z")

</div>

Hi lukastribus,

I’ve disabled roundrobin, heatlh checks and cookie stickiness but still i’m unable to login. once I remove “redirect scheme https if !{ ssl\_fc }” from port 80 frondend i am able to login.

Best Regards,  
Zahid