Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We are building an application where we want anything the following to be SSL:

secure.ourapp.com -> all pages must be SSL (can this be done with a Vhost in apache?)

www.ourapp.com/signup -> SSL www.ourapp.com/login -> SSL www.ourapp.com/information -> NOT SSL

So my question is: can you put SSL on some pages and not on others? Or does it only work on a per-subdomain basis?

thanks a lot for helping me out

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Yes, with some caveats.

The 2 SSL hosts will need different public IP addresses for maximum compatibility. There is name based SSL, but Apache doesn't support that.

There's nothing stopping you supporting SSL for all pages on the main site and simply using SSLRequireSSL for the relevant /login area to deny access without SSL. Then you can simply direct people to https:// from the signup page and back to http:// when leaving the login page.

If you want to get a little fancier you could use the re-write options to redirect people who connect using the "wrong" protocol. I do something like that with Lighttpd.


Yes. You need 2 certificates and then use the SSLRequireSSL option for the parts you want to protect with SSL. I'd suggest that using a rewrite is kinder on visitors than simply denying access to HTTP connections to /signup in particular. See this page for an example of how to do that.

share|improve this answer
2  
Re: name-based SSL (TLS), Apache does support this in recent versions via SNI - See wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI . For maximum compatibility you should still have separate IPs for each SSL vhost though... –  voretaq7 Mar 24 '10 at 18:04
    
Interesting, thanks. None of their core documentation mentions this. –  Cry Havok Mar 24 '10 at 18:07
    
thanks! So do you mean that we should do the following: 1. set up SSL certificate for www.app.com and only requireSSL for /signup and /login (these are not directories but php controllers) 2. set up another SSL certificate for secure.app.com ? –  solsol Mar 24 '10 at 18:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.