Redirect http to https only works after page refresh Apache2

Question

I have installed SSL Certificates on my website and on the example.com everything works fine, meaning that typing example.com redirects correctly to https://example.com. However, I have installed a certificate for a subdomain as well such that the link becomes: subdomain.example.com.

My goal is to have subdomain.example.com redirect to https://subdomain.example.com . This might sound weird but this semi-works meaning that when I first surf to subdomain.example.com it uses the http protocol but when I refresh that same page it switches to https protocol.

This is my VirtualHost conf file (port 80):

<VirtualHost *:80>
  ServerName subdomain.example.com
  ServerSignature Off

  ProxyPreserveHost On

  AllowEncodedSlashes NoDecode

  <Location />
    Require all granted

    ProxyPassReverse http://127.0.0.1:8181
    ProxyPassReverse http://example.com/
  </Location>

  RewriteEngine on

  #Forward all requests to gitlab-workhorse except existing files like error documents
  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
  RewriteCond %{REQUEST_URI} ^/uploads/.*
  RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE]

  # needed for downloading attachments
  DocumentRoot /opt/gitlab/embedded/service/gitlab-rails/public

RewriteCond %{SERVER_NAME} =subdomain.example.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

#RewriteCond %{SERVER_PORT} !443
#RewriteRule ^(/(.*))?$ https://%{HTTP_HOST}/ [R=301,L]

</VirtualHost>

I have removed to non related lines from this sample above. Here is the 443 conf file:

< IfModule mod_ssl.c>
SSLStaplingCache shmcb:/var/run/apache2/stapling_cache(128000)
<VirtualHost *:443>
ServerName subdomain.example.com
ServerSignature Off
<    IfModule mod_ssl.c>
    SSLStaplingCache shmcb:/var/run/apache2/stapling_cache(128000)
    <VirtualHost *:443>
      ServerName subdomain.example.com
      ServerSignature Off

      ProxyPreserveHost On

      AllowEncodedSlashes NoDecode

      <Location />
        Require all granted

        #Allow forwarding to gitlab-workhorse
        ProxyPassReverse http://127.0.0.1:8181
        ProxyPassReverse http://domain/
      </Location>

      RewriteEngine on

      #Forward all requests to gitlab-workhorse except existing files like error documents
      RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
      RewriteCond %{REQUEST_URI} ^/uploads/.*
      RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE]

      # needed for downloading attachments
      DocumentRoot /opt/gitlab/embedded/service/gitlab-rails/public


    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/subexample.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
    Header always set Strict-Transport-Security "max-age=31536000"
    SSLUseStapling on
    Header always set Content-Security-Policy upgrade-insecure-requests
    </VirtualHost>
    </IfModule>

Worth noting is that I am using certbot.

Hopefully someone can help me.

Answer 1

You say "My goal is to have subdomain.example.com redirect to https://subdomain.example.com".

Then why have all that proxy configuration in your :80 VirtualHost? Simply force the redirection to :443, and let :443 handle the proxy (and other).

So your VirtualHost would become:

<VirtualHost *:80>
    ServerName subdomain.example.com
    CustomLog logs/subdomain_80_access.log combined
    ErrorLog  logs/subdomain_80_error.log

    RewriteEngine On
    RedirectMatch ^/(.*)$ https://subdomain.example.com/$1

</VirtualHost>