I read this issue. But I didn't understand it. Like the author I don't have an SSL certificate and I don't want to have one (because if I had one I could live with HTTPS!).

I just want to process any https://<url> request like it was http://<url>. It can be a redirect but the answer states:

server.on("/redirect/internal", HTTP_GET, [](AsyncWebServerRequest *request){

server.on("/redirect/external", HTTP_GET, [](AsyncWebServerRequest *request){

Ok, but how to detect if the request was HTTP or HTTPS?

  • 1
    the web browser will probably freak out if you redirect to an unsecure webpage
    – jsotola
    Nov 21, 2022 at 17:21
  • 1
    http uses port 80 ... https uses port 443
    – jsotola
    Nov 21, 2022 at 17:22

1 Answer 1


This isn't something you can do.

What you're asking for is like saying "I have to screw something together but I really only want to use a hammer, so how do I hammer the screw?". The answer is, you don't.

In this case the ESP32 is a server. The web browser is a client. The web browser is speaking HTTPS. When the browser makes an HTTPS request to the server, HTTPS is the only thing the browser will accept. HTTPS include a security layer (that's the "S" part) which is what requires certificates. If the server is not capable of handling that security layer (which it's not if it doesn't have an SSL certificate) then the only thing it can do is reject the connection by either not listening for it or immediately closing it

There is no communication between the client and server if the server isn't configured with certificates and can't speak TLS (the security layer) with the client. Allowing the server to downgrade the security when the client requests it would be a huge general security issue for the web. It's designed to not allow this.

Either support HTTPS properly, get the client to speak HTTP, or just don't do this at all. Those are your options.

As for detecting HTTP vs HTTPS, it depends on the port your server listened on. If you listen on port 80, you get HTTP requests. If you listen on port 443 you get HTTPS. If you're not listening on a port, the request of that type is refused (reset).

  • Ok got it. I thought it was easier because I saw some IoT devices that do this. Just a clarification: it's not a www application, it's just a configuration page hosted on an MCU device. No security issue here. And TLS is an overkill for this kind of job. Unfortunately, if you don't specify the protocol the browsers assume it's HTTPS and most users wonder why the page is not loaded...
    – Mark
    Nov 21, 2022 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.