[DEV]

Quick answer
After installing a valid website certificate, redirect HTTP requests to HTTPS. This aaPanel Free Edition guide uses a custom Nginx rewrite rule that preserves the hostname, path and query string, while keeping the ACME challenge path available for certificate validation.

Before you start
Confirm both HTTPS hostnames work without certificate warnings. This example is for Nginx, not Apache or OpenLiteSpeed. Back up existing rewrite rules before editing them; retain any application rules below the new redirect block.
Install website SSL first.

1. Open the rewrite editor
Go to Website, open your site's settings, and choose URL rewrite. Our new lab site had an empty rule file. Do not replace an existing application's rewrite configuration blindly.

2. Add the redirect block
Place this block above your application rewrite rules:

Code:Copy

# AdminsForum tutorial: HTTPS redirect with ACME exception set $af_https_redirect 0; if ($scheme = http) { set $af_https_redirect 1; } if ($uri ~ "^/\.well-known/acme-challenge/") { set $af_https_redirect 0; } if ($af_https_redirect = 1) { return 301 https://$host$request_uri; }

The first condition marks HTTP requests for redirection. The next clears that flag for the ACME challenge path. The final return performs the redirect. HTTPS requests are not redirected by this block.



3. Save and test
Click Save. If aaPanel reports a configuration error, restore your previous rules rather than leaving an invalid configuration. Our Nginx configuration test passed after saving.
Check HTTP and HTTPS separately. Our results were:

Code:Copy

http://adminslab.com/ -> 301 -> https://adminslab.com/ http://www.adminslab.com/test-path?check=1 -> 301 -> https://www.adminslab.com/test-path?check=1 https://adminslab.com/ -> 200

We also placed a temporary text file under /.well-known/acme-challenge/ and confirmed it returned HTTP 200 directly, then removed the test file. A nonexistent challenge URL can behave differently because the server's error-page rules also run.

Important limits

• This is a permanent 301 redirect; browsers may cache it. Use a fresh request when testing a rollback.
  
• This preserves www and non-www rather than choosing a canonical hostname.
  
• We tested the certificate-validation route, not a future certificate renewal.
  
• Cloudflare records remain DNS only. Do not combine this setup with an incompatible proxy SSL mode that creates a loop.
  
• If you later select a rewrite template, check that it has not replaced this custom block.
  

Troubleshooting
A redirect loop usually means HTTPS is being redirected again or another proxy/application rule conflicts. Restore your saved rules and inspect the complete chain. A certificate warning must be fixed at the certificate level, not hidden with a redirect.

Tested: 10 October 2026, aaPanel Free Edition 8.0.6 with Nginx. Original AdminsForum lab screenshot.