After two days of searching, I decided to ask this question here:

I have extremely limited lighttpd installed on my iDevice, and I need to redirect all received https traffic to http. I don't have mod_rewrite nor do I have ssl compiled in.

I came up with this, but it doesn't seem to work:

$SERVER["socket"] == ":443" {
 $HTTP["host"] =~ ".*" {
  url.redirect = ( ".*" => "http://%1" )
 }
}

Also, for lighttpd to get the port 443 traffic, do I need to set server.port to 443, or can I just leave it = 80 in the config file?

Thanks in advance!

link|improve this question
feedback

1 Answer

up vote 1 down vote accepted

If you're not using SSL, then your version of lighttpd will be unable to respond to an incoming HTTPS request as it will be unable to decode the response (which will be SSL encrypted by the client's browser).

It will also be unable to reply over HTTPS with the Redirect reply.

You'll need to compile Lighttpd with SSL support, or put at least something in there on port 443 which can decrypt SSL (perhaps openssl with the s_server option in HTTPS mode).

link|improve this answer
I thought that the servername isn't encrypted when https is used. What I mean is: in example.com/stuffhere, example.com isn't encrypted, is visible (which you can see when doing arp and dns spoofing), while stuffhere is encrypted. – linkxs Oct 17 '11 at 17:02
@linkxs No, all traffic from the initiation of the HTTP request is encrypted. Clients connecting to your server with https:// in their address bar will get an error. – Shane Madden Oct 17 '11 at 18:21
Then how come arpspoof catches facebook.com? The issue is that it can't do anything with it past that point. – linkxs Oct 17 '11 at 23:37
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.