1

I have ssl installed on the server but i want to use it only for a particular directory for eaxmple for www.domain.com/users and not for any other thing on the server eg. www.domain.com?

2
  • Your going to need more details, operating system? Web service?
    – AliGibbs
    Feb 16, 2011 at 16:27
  • 1
    i am using apache2 with ubuntu Feb 16, 2011 at 16:29

2 Answers 2

3

You probably want two things.

  1. Require SSL on that directory:

    <Directory "/usr/local/www/path/to/directory">
        SSLRequireSSL
    </Directory>
    
  2. Redirect people reaching that page by http to use https:

    RewriteEngine on
    RewriteCond %{REQUEST_URI} ^/path/to/directory [NC]
    RewriteCond %{SERVER_PORT} !^443$
    RewriteRule ^(.*)$ https://example.com$1 [R=301,L]
    

There are other ways of accomplishing the same thing; if this doesn't work well for your situation, say so and we can work out the details of what you're trying to accomplish.

0
1

I don't know that you really want to do what you're asking (use SSL for one directory and deny it for others) -- More common is wanting to require SSL for one directory and allowing it to be optional for all others.

To require SSL simply create a <Directory> (or <Location>) block and add the SSLRequireSSL directive to it (More info on that directive can be found in the Apache manual).

If you indeed do want to deny SSL for all other directories you can use mod_rewrite on top of the above solution to do so (rewrite https://anything-that-doesnt-match/your/secure/directory to http://....), but note that some browsers may balk at https:// URLs being rewritten to http://.
Implementing that mod_rewrite rule is between you, the mod_rewrite section of the Apache manual, and whatever alcoholic beverage you use to cope with mod_rewrite :-)

2
  • Thanks for the answer. i am trying to protect the user area with ssl while the other areas are just http. Feb 16, 2011 at 16:52
  • @Aditya Normally you would require SSL for the user area (with SSLRequireSSL), and allow it to be optional for the other parts of the site (which is the default behavior). This requires a lot less configuration-wrangling than prohibiting it for the rest of the site :)
    – voretaq7
    Feb 16, 2011 at 16:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .