Redirect HTTP requests to HTTPS

This example shows how to use URL map redirects to redirect all requests from HTTP to HTTPS. This example shows how you set up redirects by using the well-known ports 80 (for HTTP) and 443 (for HTTPS). However, you're not required to use these specific port numbers. Each forwarding rule for an Application Load Balancer can reference a single port from 1-65535.

HTTPS uses TLS (SSL) to encrypt HTTP requests and responses, making it safer and more secure. A website that uses HTTPS has https:// in the beginning of its URL instead of http://.

For new HTTPS Application Load Balancers

If you're creating a new HTTPS Application Load Balancer, you can use the Google Cloud console to set up an HTTP-to-HTTPS redirect.

While creating the load balancer's frontend, use the following steps:

  1. In the Google Cloud console, go to the load balancer's configuration page.

    Go to Load balancing (Create global external Application Load Balancer)

  2. For Load balancer name, enter a name.
  3. Click Frontend configuration.
  4. For Protocol, select HTTPS (includes HTTP/2).
  5. For IP address, click Create IP address. Enter a name for the new static IP address and click Reserve.
  6. For Certificate, select an SSL certificate.
  7. To create the redirect, select the Enable HTTP to HTTPS Redirect checkbox.
  8. Click Done.
  9. Complete the backend and other required configurations.
  10. Click Create.

You must select the HTTPS protocol and use a reserved IP address (not ephemeral) to be able to select the checkbox.

HTTP-to-HTTPS redirect checkbox in the Google Cloud console.
Figure 1. HTTP-to-HTTPS redirect checkbox in the Google Cloud console (click to enlarge).

Depending on your backend type, use the Google Cloud console instructions from one of the following guides to complete this setup:

Setting the Enable HTTP to HTTPS Redirect checkbox automatically creates an additional partial HTTP load balancer consisting of a URL map, a forwarding rule, and a target HTTP proxy. This partial HTTP load balancer uses the same IP address as your HTTPS load balancer and redirects HTTP requests to your load balancer's HTTPS frontend. It uses 301 Moved Permanently as the default redirect response code.

After the HTTPS load balancer is created, you can see the partial HTTP load balancer in the list of load balancers, with a -redirect suffix. Test your setup by using the steps in Testing the HTTP-to-HTTPS redirect.

For existing load balancers

If you already have an HTTPS Application Load Balancer (called here LB1) that is serving HTTPS traffic on port 443, you must create a partial HTTP Application Load Balancer (called here LB2) with the following setup:

  • The same frontend IP address used by LB1
  • A redirect configured in the URL map

This partial HTTP load balancer uses the same IP address as your HTTPS load balancer and redirects HTTP requests to your load balancer's HTTPS frontend.

This architecture is shown in the following diagram.

HTTP-to-HTTPS redirect configuration architecture.
Figure 2. HTTP-to-HTTPS redirect configuration architecture (click to enlarge).

Redirecting traffic to your HTTPS load balancer

After you have verified that your HTTPS load balancer (LB1) is working, you can create the partial HTTP load balancer (LB2) with its frontend configured to redirect traffic to LB1.

This example uses the 301 response code. You can instead use a different response code.

To configure the redirect with gcloud, you must import a YAML file and make sure that your target HTTP proxy points to the URL map that redirects traffic. If you're using the Google Cloud console, this is handled for you.

Regional external Application Load Balancers aren't supported in the Google Cloud console.

gcloud

  1. Create a YAML file /tmp/web-map-http.yaml. This example uses MOVED_PERMANENTLY_DEFAULT as the response code.
    2.        kind: compute#urlMap
       name: web-map-http
       defaultUrlRedirect:
         redirectResponseCode: MOVED_PERMANENTLY_DEFAULT
         httpsRedirect: True
       tests:
       - description: Test with no query parameters
         host: example.com
         path: /test/
         expectedOutputUrl