Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have ssl installed on the server but i want to use it only for a particular directory for eaxmple for www.domain.com/users and not for any other thing on the server eg. www.domain.com?

share|improve this question
    
Your going to need more details, operating system? Web service? –  AliGibbs Feb 16 '11 at 16:27
    
i am using apache2 with ubuntu –  Aditya Shukla Feb 16 '11 at 16:29

2 Answers 2

up vote 3 down vote accepted

You probably want two things.

  1. Require SSL on that directory:

    <Directory "/usr/local/www/path/to/directory">
        SSLRequireSSL
    </Directory>
    
  2. Redirect people reaching that page by http to use https:

    RewriteEngine on
    RewriteCond %{REQUEST_URI} ^/path/to/directory [NC]
    RewriteCond %{SERVER_PORT} !^443$
    RewriteRule ^(.*)$ https://example.com$1 [R=301,L]
    

There are other ways of accomplishing the same thing; if this doesn't work well for your situation, say so and we can work out the details of what you're trying to accomplish.

share|improve this answer
    
thanks works well .mod_rewrite looks really amazing. –  Aditya Shukla Feb 16 '11 at 18:40

I don't know that you really want to do what you're asking (use SSL for one directory and deny it for others) -- More common is wanting to require SSL for one directory and allowing it to be optional for all others.

To require SSL simply create a <Directory> (or <Location>) block and add the SSLRequireSSL directive to it (More info on that directive can be found in the Apache manual).

If you indeed do want to deny SSL for all other directories you can use mod_rewrite on top of the above solution to do so (rewrite https://anything-that-doesnt-match/your/secure/directory to http://....), but note that some browsers may balk at https:// URLs being rewritten to http://.
Implementing that mod_rewrite rule is between you, the mod_rewrite section of the Apache manual, and whatever alcoholic beverage you use to cope with mod_rewrite :-)

share|improve this answer
    
Thanks for the answer. i am trying to protect the user area with ssl while the other areas are just http. –  Aditya Shukla Feb 16 '11 at 16:52
    
@Aditya Normally you would require SSL for the user area (with SSLRequireSSL), and allow it to be optional for the other parts of the site (which is the default behavior). This requires a lot less configuration-wrangling than prohibiting it for the rest of the site :) –  voretaq7 Feb 16 '11 at 16:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.