Secure browser redirect to https (ssl) using php

As we know that all transactions over internet uses SSL (secure socket layer) connection to transfer data to and from the payment gateway. commonly most of websites uses “HTTP” protocol but When we need to integrate payment gateways on e-commerce site or any other. Then we need to redirect the browser from common “HTTP” to Secure “HTTPS” which mean that “Hypertext Transfer Protocol over Secure Socket Layer”.

We can see the real example of HTTPS in Banks, reservation sites when we type “HTTP” it automatically converts to “HTTPS” in address bar which means this site is transferring the data over SSL protocal.

Redirect the browser to https when site is using http protocal in PHP

First of all, you will have to configure SSL on your server. After we will check that the site is using SSL or not by PHP server varriable called $_SERVER['HTTPS'] which return “ON” valuewhen the site is using SSL Connection.

PHP Function to redirect the browser to “https”

function redirectToSecureHTTPS()
{
if($_SERVER['HTTPS']!="on")
{
$redirect= "https://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
header("Location:$redirect");
}
}

This is a very simple php fucntion, you can call this function in the page where you’ve to redirect the browser to “https”.

Redirect the browser to “https” using .htaccess

The above php function need to be call on each page to redirect the browser to “https”. But by using .htaccess file, you can redirect the whole website to use SSL connection throughout the pages.

RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

You just need to copy and paste the above code in .htaccess file and the whole website will be redirected to “https”. The browser will be et redirected using url rewriting in .htaccess.

PHP, SSL, and cURL SSL3_GET_SERVER_CERTIFICATE Errors

I recently developed a complex system for a customer that involved PHP, cURL, and a SSL connection to a third party vendor. The third party vendor would validate the security certificate of the source (the system I created) and either allow or reject access. My code looked like this:

$ch = curl_init();

curl_setopt($ch,CURLOPT_URL,'https://thirdparty.com/token.php'); //not the actual site

curl_setopt($ch,CURLOPT_TIMEOUT,60);

curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);

curl_setopt($ch,CURLOPT_POST,1);

curl_setopt($ch,CURLOPT_POSTFIELDS,'customer_id='.$cid.'&password='.$pass);

curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,true); 

curl_setopt($ch,CURLOPT_CAINFO,'ca-bundle.crt'); /* problem here! */

$result = curl_exec($ch);

if(empty($result)) { /* error: nothing returned */ } else { /* success! */ }

curl_close($ch);

Unfortunately I was persistently receiving the following error message:

error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

It turns out that the SSL bundle file I was using was old, as was the default bundle that came with the old version of cURL the shared hosting server. Essentially the third party didn’t trust that the system’s SSL certificate was valid. I downloaded Mozilla’s bundle file, named itmozilla.pem and changed my PHP code to:

$ch = curl_init();

curl_setopt($ch,CURLOPT_URL,'https://thirdparty.com/token.php'); //not the actual site

curl_setopt($ch,CURLOPT_TIMEOUT,60);

curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);

curl_setopt($ch,CURLOPT_POST,1);

curl_setopt($ch,CURLOPT_POSTFIELDS,'customer_id='.$cid.'&password='.$pass);

curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,true); 

curl_setopt($ch,CURLOPT_CAINFO,'mozilla.pem'); /* fixed! */

$result = curl_exec($ch);

if(empty($result)) { /* error: nothing returned */ } else { /* success! */ }

curl_close($ch);

I share this with you because it cost me over three hours. Hopefully this will save someone time and frustration in the future.