Rewriting to https without a certificate?

Question

Our environment looks as follows:

HLB (Ace) --> redundant Apache servers --> Backend Websphere servers

Secure Traffic coming into the Load Balancer, where the SSL Certificate is decrypted. The request is then forwarded to one of the two apache webservers. Apache then forwards the request to the appropriate Websphere Application server if needed. Websphere replies back to the client via the same path.

Our Networking group is telling us that SSL shall not be installed on the webservers as it prevents them from packet tracing.

For our in house written application we are redirecting relatively so when a URL is redirected it stays HTTPS externally as. However we have a purchased product that processes and then sends an absolute redirect back to the client as an HTTP. We believe this is because apache receives the request un-encrypted.

We are trying to find a way to have apache rewrite the protocol to https for the application in Websphere (the application is Vignette Portal)

I've tried a simple

<Location /LocationINeed>
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</Location>

but that didn't work. According to what I read this absolute forces a direct redirect to the client and ends up creating a loop.

I'm a fairly inexperienced apache admin, and have spent the day searching the web looking at MOD_substitutem and mod_rewrite but all my attempts have fallen short.

If you've encountered this I'd love to hear how you solved the issue.

Answer 1

If there are some absolute links within the pages served by your application that use http:// to point to itself, you're going to have to fix the application.

If it's just about the Location headers, you could try an approach similar to this: use mod_headers and use a rule along these lines:

Header edit Location ^http://www.example.com/hudson/ https://www.example.com/hudson/

EDIT:

A bit of background on why this happens: the reason why this is a problem with HTTP Location headers and not with relative links within a page is that the Location header always require an absolute URI, according to the spec:

[...] The field value consists of a single absolute URI.

   Location       = "Location" ":" absoluteURI

(To be honest, I think some browsers might be able to understand a relative URI and interpret it as relative to the initial request they sent. However, that would be out of spec, and some tools/browsers will just not like it.)