Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a (hopefully) common scenario for one of my sites that I just can't seem to figure out how to deploy correctly.

I have the following site and directories for

These need to require SSL:

  • /var/www/
  • /var/www/

These need to be non-SSL:

  • /var/www/

These need to support both:

  • /var/www/
  • /var/www/
  • /var/www/

I have two virtual host declarations for in my /sites-available/ file; the top one is *:443 the second one is *:80.

Since I have two vhost declarations, if a request comes in on 443, the top virtualhost is used, same with the bottom if it's a port 80 request.

However, I can't seem to enforce my SSL requirements using SSLRequireSSL because I'm assuming a port 80 request to /admin or /order is not even hitting the *:443 vhost.

Should I just Deny All to /order and /admin within the *:80 virtual host so that if you try to request it on 80, you'll get a 403 Forbidden?

share|improve this question
up vote 1 down vote accepted

better yet, redirect it to ssl (or back) automatically

in non ssl vhost:

Redirect /admin
Redirect /admin

in ssl vhost (if you really want /maps always to be non-ssl, to save cpu maybe?)

Redirect /maps
share|improve this answer
/maps pages use Google Static Maps, and without Premier (too much $$$), SSL is not supported so IE throws non-SSL content warnings. That's definitely a more friendly way of doing it; thanks. – gravyface Mar 25 '10 at 21:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.