1

At the moment I am using http and https as different port. And based on request uri, I made a redirection rule from http to https switch and vice versa. But If I can use only a single port for https and https in lighttpd. That will be the best solution.

Is there any other way to do that. If it is not available by lighttpd itself. How about some combination of tomcat and lighttpd, still is it impossible?

2 Answers 2

3

Not feasible. HTTP and HTTPS are two distinct services which behave in markedly different ways (despite the naming and payload being similar). Unique services must bind to unique ports to enable client and server to communicate in a language both understand.

To accomplish this you would need to have a client that would connect to the port, negotiate which type of connection is to be made (HTTP or HTTPS), then switch to the appropriate communication mode. That negotiation logic doesn't exist on the clients, so there's no way for you to implement this server-side.

2

What you're wishing for is STARTTLS for HTTP. This is actually proposed by RFC 2817, which was written in what is now Ye Olden Days of Yon Internete. I found some quick references that suggested that both Apache and lighthttpd support this, but further research is disappointing for lighttpd — sorry about that. Here's the documentation for setting it up with Apache, though; basically:

<VirtualHost _default_:80>
SSLEngine optional
...
</VirtualHost> 

There's also no client support. IE7 supports some nifty TLS extensions (name-based SSL certificates may be possible in our lifetime), but apparently not STARTTLS/RFC 2817. And there's an open bug for Mozilla, with a lot of details still to be worked out. One of the issues is the RFC makes encryption really optional, and that's not generally desirable for most applications of encryption on the Internet. But since you're using a custom client, neither the lack of general browser support nor the security issue is a concern.

2
  • Great! That is a good information for now. Basically Webserver runs on https except only some uri , only for those uri I want http operation. Luckily the client for http is not a standard application. With these restriction, STARTTLS for HTTP will be the solution. Here is another two question. Q1: But how can I use STARTTLS for HTTP with lighttp ? Base on lighttpd document ; (redmine.lighttpd.net/projects/lighttpd/wiki/Docs:ModAuth) Do I have to add LDAP server module? Q2. STARTTLS for HTTP is only for authentication or even data encrypted like as HTTPS ?
    – agfe2
    Dec 1, 2010 at 7:42
  • Oh, man, I might have misread that document. It looks like it only uses STARTTLS for the ldap backend connection. I'll fix my answer.
    – mattdm
    Dec 1, 2010 at 13:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .