What's the best way to deal with an entire existing site moving from http to https?

[JasonCooper]

I have a client that just switched their entire site from the standard unsecure (http) to secure (https) because of over-zealous compliance issues for protecting personal information in the health care realm.

They currently have the server setup to 302 redirect from the http version of a URL to the https version.  My first inclination was to have them simply update that to a 301 and be done with it, but I'd prefer not to have to 301 every URL on the site.

I know that putting a rel="canonical" tag on every page that refers to the http version of the URL is a best practice (http://www.google.com/support/webmasters/bin/answer.py?hl=en&answer=139394), but should I leave the 302 redirects or update them to 301's.  Something seems off to me about the search engines visiting an http page, getting 301 redirected to an https page and then being told by the canonical tag that it's actually the URL they were just 301 redirected from.

[AlanBleiweiss]

Jason,

I've got financial clients with the same paranoia mentality.  Maybe they went to the same security conference.  As unpleasant as it is to perform 301 redirects, it's the right thing to do. Unless you think 3 months from now a new compliance officer will recognize the foolishness of the implementation and reverse it. Leaving 302s dangling isn't healthy.

[JasonCooper]

Thanks for the fast response Alan.  So should I not put rel=canonical tags on the page that refer to the http versions of the URL and just do the 301's and suck it up?

[AlanBleiweiss]

Doing both covers all the bases.  I can't recall who it was that did the test (@TonyAdam on Twitter I think) but the test involved rel=canonical and 301s being implemented, and the discovery was that rel=canonical was acknowledged faster than the 301s. And at the very least, doing both won't hurt.