Automating SSL/TLS & HTTPS Redirection for OJS Journals
Complete walkthrough for implementing HTTPS across your OJS publishing portal. Learn how to configure Certbot automated renewals, eliminate mixed content warnings, and enforce HSTS.
Real Problem
Many journals suffer from broken styling and submission form errors after enabling SSL because of mixed content warnings and unconfigured force_ssl settings in config.inc.php.
Practical Solution
Deploy automated Let’s Encrypt TLS certificates using Certbot, configure Nginx/Apache 301 HTTPS redirections, and update OJS configuration settings to enforce end-to-end cryptographic encryption.
Why HTTPS is Mandatory for Scholarly Publishing
In academic publishing, cryptographic security is not an optional feature. Major indexing databases—including Web of Science, Scopus, DOAJ, and Google Scholar—mandate HTTPS compliance for automated indexing and OAI-PMH metadata harvesting.
Furthermore, editors and peer reviewers transmit confidential critiques and authentication credentials. Transmitting these over unencrypted HTTP exposes credentials to packet sniffing and man-in-the-middle (MITM) attacks.
Installing Certbot and Obtaining Let’s Encrypt Certificates
Certbot provides free, automated 90-day TLS certificates with automated renewals. Install Certbot via Snap for the most up-to-date cryptographic libraries:
snap install core && snap refresh core
snap install --classic certbot
ln -s /snap/bin/certbot /usr/bin/certbot
Obtain and configure the certificate for your Nginx virtual host:
certbot --nginx -d journal.institution.edu -d www.journal.institution.edu
Certbot will automatically verify domain ownership via the ACME HTTP-01 challenge, issue the certificate, and update your Nginx server block with modern TLS 1.2/1.3 ciphers.
Configuring OJS config.inc.php for HTTPS Enforcement
Once the web server successfully serves HTTPS traffic, you must inform OJS that it is operating behind a secure connection. Open config.inc.php:
[general]
base_url = "https://journal.institution.edu"
[security]
force_ssl = On
force_login_ssl = On
Setting force_ssl to On ensures that all internal URLs generated by OJS—including pagination links, stylesheet bundles, and submission API endpoints—are rendered using https://.
Eliminating Mixed Content Errors
If your journal was previously accessible via plain HTTP, database tables may contain absolute http:// links in article abstracts, sidebar custom blocks, or issue cover descriptions. When these are served over HTTPS, browsers block the insecure resources, resulting in broken layouts.
Run a safe database search-and-replace to update legacy links:
UPDATE journal_settings SET setting_value = REPLACE(setting_value, 'http://journal.institution.edu', 'https://journal.institution.edu') WHERE setting_name IN ('masthead', 'contactTitle', 'customBlocks');
Automating Renewal Verification
Let’s Encrypt certificates expire every 90 days. Certbot installs a systemd timer to handle automated renewals. Verify renewal functionality with a dry run:
certbot renew --dry-run
Step-by-Step Action Plan
Verify DNS Records
Confirm that your journal domain and all subdomains point to your server IP address via A/AAAA records.
Install Certbot & Web Server Plugin
Install certbot and python3-certbot-nginx (or python3-certbot-apache) via snap or apt.
Issue Automated TLS Certificate
Run certbot --nginx -d journal.example.com to obtain and bind the certificate.
Configure force_ssl in config.inc.php
Update force_ssl = On and force_login_ssl = On in the [security] section of config.inc.php.
Resolve Mixed Content Assets
Scan journal CSS and issue cover URLs to ensure all static assets reference https:// rather than http://.
Questions People Usually Ask
What happens if force_ssl is set to On without an active SSL certificate?
The journal will enter an infinite redirect loop (ERR_TOO_MANY_REDIRECTS) or fail to load with a connection refused error. Always verify your certificate in the browser before enabling force_ssl.
How do I resolve mixed content warnings on OJS article pages?
Mixed content warnings occur when article abstracts or custom CSS reference insecure http:// image or font links. Update your base_url setting in config.inc.php to use https:// and replace hardcoded http:// links in journal settings.
Does Google Scholar penalize journals that lack HTTPS?
Yes. Google Scholar crawler guidelines explicitly prioritize secure HTTPS endpoints. Insecure journals frequently encounter crawling failures and reduced search ranking visibility.
Eliminate "Not Secure" Warnings on Your Journal
AcademiaTech installs automated SSL certificates, resolves mixed-content styling bugs, and enforces military-grade encryption for scholarly portals.