title: How to redirect HTTPS requests to HTTP without a certificate (Apache VirtualHosts) and avoid a certificate warning
body: <blockquote>
    <p>I would first like to first say, this is not good practice and we should endevour to have everything on HTTPS 100% of the time but in this case I had a series of awkward requirements on a system that did not hold sensitive information. I was quite ignorant of how HTTPS/TLS worked when asking this question back when I was more junior but have left it in place to help others as it receives a fair amount of attention. <a href="https://hpbn.co/transport-layer-security-tls/" rel="nofollow noreferrer">I recommend reading Oreily's TLS 101 if you're interested.</a>
    You can now get free TLS certificates using <a href="https://letsencrypt.org/" rel="nofollow noreferrer">Let's Encrypt</a> which I thoroughly recommend. Lastly, if you are using the default Apache config please check out <a href="https://mozilla.github.io/server-side-tls/ssl-config-generator/" rel="nofollow noreferrer">Mozilla's SSL config generator</a> selecting 'Modern' after entering your apache version.</p>
  </blockquote>
  
  <p>I am hosting a couple of seperate websites on one apache server:</p>
  
  <p><strong>site.com</strong> </p>
  
  <p>site.com redirects all users to HTTPS from within the application.</p>
  
  <p><strong>example.com</strong> </p>
  
  <p>example.com is an HTTP website and HTTPS requests are redirects to HTTP</p>
  
  <hr>
  
  <p>In order for accidental requests for <a href="https://example.com" rel="nofollow noreferrer">https://example.com</a> instead of <a href="http://example.com" rel="nofollow noreferrer">http://example.com</a> to not get site.com (due to when only one HTTPS vhost is used that becomes the default site) I need to set up an https vhost for example.com but I have to use a self signed cert as there is no reason for the site to use an SSL.</p>
  
  <p>This means when someone visits <a href="https://example.com" rel="nofollow noreferrer">https://example.com</a> they get a browser warning page that the SSL is self signed and then as soon as they click continue they get redirected to HTTP</p>
  
  <p>Is there any way to redirect HTTPS requests to HTTP without a certificate</p>
  
  <p>This is the current vhost:</p>
  
  <pre><code>&lt;VirtualHost *:443&gt;
          ServerName about.example.com:443
  
          DocumentRoot "/directory"
          &lt;Directory "/directoy"&gt;
                  AllowOverride All
                  Require all granted
          &lt;/Directory&gt;
  
          RewriteEngine On
          RewriteCond %{HTTPS} on
          RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI}
  
          SSLEngine on
          SSLCertificateFile /etc/httpd/ssl/ExampleCOM.pem
          SSLCertificateKeyFile /etc/httpd/ssl/AboutExampleCOM-key.pem
          Header always set Strict-Transport-Security "max-age=15768000"
  &lt;/VirtualHost&gt;
  
  SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 
  SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
  SSLHonorCipherOrder     on
  
  # Disabled to avoid CRIME attack
  SSLCompression          off
  
  # this usually compromises perfect forward secrecy
  SSLSessionTickets       off
  
  # OCSP Stapling, httpd 2.3.3 or later
  SSLUseStapling          on
  SSLStaplingResponderTimeout 5
  SSLStaplingReturnResponderErrors off
  SSLStaplingCache        shmcb:/var/run/ocsp(128000)
  </code></pre>