SSL Subdomain Staging Site in Subfolder is Resolving Webroot Instead

Question

I'm trying to set up a staging subdomain in a subfolder under the webroot of the main production site for testing and deploying changes for a EE e-commerce website.

I hope one or two of the more experienced EE Devs that contribute here can easily spot how I can make things work for this set up.

For the most part, things are working as they should except for testing transactions on the checkout pages, which are the only SSL templates on the website.

Directories:

public_html (http://www.domain.com or https://www.domain.com)
↳ staging (http://staging.domain.com or https://staging.domain.com)

When going to http://staging.domain.com the 2nd installation in the subfolder runs just fine.

When going to https://staging.domain.com the 1st installation is being rendered instead. The production site DOES NOT have a wildcard domain SSL setup... which looks to be the reason this is happening. This previous SE post has been insightful.

On other CMSs, I've easily solved this issue simply by adding the following to the webroot .htaccess file:

RewriteCond %{HTTP_HOST} ^staging\.
RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ staging/$1 [L]

The subdomain commerce pages do not actually need to be properly secured to avoid certificate warnings, because it is locked off from public access and it is only used by myself and a staff member to test changes before they are pushed to production.

I don't have access to httpd.conf on this server, so over recent days I've tried numerous htaccess approaches. They all result in either 500 internal server errors, 404s or 403s.

Here are a few. All of these are being placed in the webroot to try and catch the subdomain SSL misdirection:

################# Redirect requests to subfolder EE index file = White Death
RewriteCond %{HTTP_HOST} ^staging\.
RewriteCond %{REQUEST_URI} !^/staging/
RewriteCond %{REQUEST_FILENAME} !-f 
RewriteCond %{REQUEST_FILENAME} !-d 
RewriteRule ^(.*)$ /staging/$1
RewriteCond %{HTTP_HOST} ^staging\.
# Direct requests to subfolder EE's index file
RewriteRule ^(.*)$ /staging/index.php/$1 [L]

################# Document Root rewrite = Displays webroot not subdomain
RewriteCond %{HTTP_HOST} ^staging\.
RewriteRule %{DOCUMENT_ROOT} /home/user/public_html/staging/$1

################# Document Root rewrite 2 = White Death
RewriteCond %{HTTP_HOST} ^staging\.
RewriteCond %{DOCUMENT_ROOT} /home/user/public_html
RewriteCond %{DOCUMENT_ROOT} !/home/user/public_html/staging
RewriteRule (.*)  /home/user/public_html/staging/$1 [PT] (Tried pretty much every flag I could think of here)

################# SSL 443 port subdomain redirect webroot to subfolder = 403 errors
RewriteCond %{SERVER_PORT} ^443$
RewriteCond %{HTTP_HOST} ^staging\. [NC]
RewriteCond %{REQUEST_URI} !^/staging/
RewriteRule ^(.*) staging/$1

And This is the current webroot EE rewrite for removing index.php:

RewriteCond %{THE_REQUEST} ^GET.*index\.php [NC]
RewriteCond %{REQUEST_URI} !/system/.* [NC]
RewriteCond %{REQUEST_URI} !/staging/.* [NC]
RewriteCond %{HTTP_HOST} !^staging\. [NC]
RewriteRule (.*?)index\.php/*(.*) /$1$2 [R=301,NE,L]

# Directs all EE web requests through the site index file
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]

I've also played around a bit with the config file settings on the subdomain install, to see if altering the DOCUMENT ROOT helps if SSL is detected for traffic being redirected from the webroot. I'm not sure this is the solution, but perhaps it is and I'm not applying things correctly. Here is an example:

$protocol = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 'https://' : 'http://';
if ($protocol == 'http://') {
  $base_path = $_SERVER['DOCUMENT_ROOT'];
} else {
  $base_path = $_SERVER['DOCUMENT_ROOT'] . '/staging';
}

So what I'm basically trying to do is set up the subdomain to test a few templates as SSL, without having a wildcard domain SSL in place.

Any ideas?

Thank you for any help.

Answer 1

Your comment referring to CPanel and pointing the subdomain to the subfolder means that it's created as another virtual host type setup. Without control over the server, you can't have multiple virtual hosts setup for SSL on the same IP (unless utilising SNI). This isn't fully supported in browsers either, but would be fine for testing. Doubtful if your hosting provider would support it though.

From your initial description I had assumed that you had both domains pointing at the same location, but your htaccess rewrites the staging to use the subfolder - this may then work as the webroot for the SSL is the same. Hence the comment for the htaccess example. Otherwise there's no point in making it a subfolder - it could be anywhere on the server as the 2 are separate in your current setup.

I'd suggest you point the staging subdomain to the same folder as your main site and try out some of your original rewrites in the htaccess to deliver the subfolder on matching subdomain under the non-http, then if you can get that working, there's more chance of trying the https. But I don't think the https://staging subdomain will be identifiable in the httaccess.

Assuming it can work, this should be sufficient:

RewriteCond %{HTTP_HOST} ^staging\.
RewriteRule ^(.*)$ /staging/index.php/$1 [L]

And under your main index rewrite you're already excluding the staging.