How to Fix HTTPS URLs That Default to Plaintext Connections

What are the steps to troubleshoot an HTTPS URL that defaults to a plaintext connection?

// Sample to demonstrate HTTP request handling in Node.js
const http = require('http');
const https = require('https');

http.createServer((req, res) => {
    res.writeHead(200, {'Content-Type': 'text/plain'});
    res.end('Hello, this is a plaintext response!');
}).listen(3000);

https.createServer({
  key: fs.readFileSync('key.pem'),
  cert: fs.readFileSync('cert.pem')
}, (req, res) => {
    res.writeHead(200);
    res.end('Hello, this is a secure response!');
}).listen(3443);

When you're accessing an HTTPS URL that unexpectedly defaults to a plaintext connection (HTTP), it generally indicates a misconfiguration or issue with how the server is set up. Below are detailed explanations, potential causes, and solutions to rectify this situation.

// Node.js example for redirecting HTTP to HTTPS
const express = require('express');
const app = express();

app.use((req, res, next) => {
    if (req.secure) {
        return next(); // already HTTPS
    }
    res.redirect(`https://${req.headers.host}${req.url}`); // redirect to HTTPS
});

app.get('/', (req, res) => {
    res.send('Welcome to the secure application!');
});

app.listen(80); // Redirect HTTP traffic

Causes

• Server misconfiguration: The server may not be set up correctly to handle HTTPS requests.
• SSL certificate issues: The SSL certificate might be expired, improperly installed, or not trusted.
• Incorrect URL: Ensure that the URL is correctly formatted to include 'https://' instead of 'http://'.
• Redirects: There may be incorrect URL redirection configurations that funnel HTTPS requests to HTTP. Potentially server-side redirects or CDN issues.

Solutions

• Verify the SSL certificate: Use online tools like SSL Checker to validate that your SSL certificate is correctly configured and not expired.
• Check server settings: Ensure your web server (e.g., Apache, Nginx) is configured to handle HTTPS requests appropriately.
• Use HTTP to HTTPS redirection: Implement 301 redirects from HTTP to HTTPS in your server configuration to guide users to the secure version of your site.
• Test with tools: Use tools like curl or Postman to check how your server responds to HTTPS requests. Example: `curl -I https://example.com`.

Mistake: Using an incorrect SSL certificate for the domain.

Solution: Ensure the SSL certificate matches the domain being accessed.

Mistake: Forgetting to update links from HTTP to HTTPS.

Solution: Review and update internal links, configuring them to use HTTPS.

Mistake: Failing to configure web server correctly for HTTPS traffic.

Solution: Double-check your web server’s configuration files for HTTPS rules.