htaccess to strip www and force SSL

Question

I have what I believe to be a rather well crafted .htaccess file:

RewriteEngine On

RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L,NE]

RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This says to me "strip the www. off the url and force https." And it works fine except for those people who happen to type in https://www.somedomain.com/ . Those people are presented with a warning that there is a problem with the site certificate. It seems that the www is not getting stripped in this particular case.

Answer 1

You can actually combine both rules into one:

RewriteCond %{HTTP_HOST} ^www\. [NC,OR]
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [R=302,L,NE]

Then make sure to clear your browser cache to test this.

However just remember that certificate negotiation between web server and browser happens before mod_rewrite is invoked.