Forcing SSL on /admin.php only

Question

Trying to force SSL on the admin area only (/admin.php) but running into some issues. I've installed the http support add-on (http://devot-ee.com/add-ons/https-support) and the SSL certificate is up and running with this the admin area all works fine.

However when logged in if you visit the main site it also tries to force to SSL, but for some reason pages 404 unless they have /index.php/ in the URL, making me assume this is a .htaccess issue. I'd rather not have the main site on SSL when logged in, but if this isn't possible with the https support add on then I'd be happy to just get the https site working without /index.php/

Our current .htaccess looks like this:

<IfModule mod_rewrite.c>
        RewriteEngine On

        # Redirect index.php Requests
        # ------------------------------
        RewriteCond %{THE_REQUEST} ^GET.*index\.php [NC]
        RewriteCond %{THE_REQUEST} !/system/.*
        RewriteRule (.*?)index\.php/*(.*) /$1$2 [R=301,L]

        # Standard ExpressionEngine Rewrite
        # ------------------------------
        RewriteCond $1 !\.(css|js|gif|jpe?g|png) [NC]
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        RewriteRule ^(.*)$ /index.php/$1 [L]
</IfModule>

Not being an expert I can't see why the removal of /index.php isn't working for https? Any ideas?

Answer 1

Firstly I think you should rename admin.php to something else, in line with the Post-Installation Best Practices which can be read at http://ellislab.com/expressionengine/user-guide/installation/best_practices.html

I would go for a sub-folder, and rename it something obscure like /badgers/index.php

In turn, this would make your htaccess file easier because you can now have different rules for that sub-folder.

I would also uninstall the HTTPS Support module, it makes the entire site encrypted and not just admin and so it's not quite right for you.

I am unable to test this because I'm on a silly Chromebook right now, but this may work.

    <IfModule mod_rewrite.c>
            RewriteEngine On
            RewriteBase /

            # Make visits to /badger/ HTTPS
            RewriteCond %{HTTPS} !=on
            RewriteCond %{THE_REQUEST} ^[A-Z]+\s/badger [NC]
            RewriteRule ^(badger) https://%{HTTP_HOST}%{REQUEST_URI} [NC,R=301,L]

            # Make standard visits HTTP
            RewriteCond %{HTTPS} =on
            RewriteCond %{THE_REQUEST} !^[A-Z]+\s/badger [NC]
            RewriteRule !^badger http://%{HTTP_HOST}%{REQUEST_URI} [NC,R=301,L]

            # Removes index.php from ExpressionEngine URLs
            RewriteCond %{THE_REQUEST} ^GET.*index\.php [NC]
            RewriteCond %{REQUEST_URI} !/system/.* [NC]
            RewriteRule (.*?)index\.php/*(.*) /$1$2 [R=301,NE,L]

            # Directs all EE web requests through the site index file
            RewriteCond %{REQUEST_FILENAME} !-f
            RewriteCond %{REQUEST_FILENAME} !-d
            RewriteRule ^(.*)$ /index.php/$1 [L]
    </IfModule>

HTACCESS adapted from EllisLab's (http://ellislab.com/expressionengine/user-guide/urls/remove_index.php.html) and this Stack Exchange (https://stackoverflow.com/questions/3307025/force-https-on-certain-urls-and-force-http-for-all-others)

Answer 2

The systems folks I've talked to usually advise enabling HTTPS/SSL across the entire site, not just the control panel; I'd suggest going that route, unless the client/manager is steadfast against it.