Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Apache 2.2 server with an SSL certificate hosting several services that should be only access using SSL.

ie: https://myserver.com/topsecret/ should be allowed while http://myserver.com/topsecret/ should be either denied or, ideally, redirected to https. http://myserver.com/public should not have this restriction, and should work using either http or https.
The decision to allow/deny http is made at the top level directory, and affects all content underneath it.

Is there a directive that can be placed in the Apache config to retrict access in this manner?

share|improve this question

migrated from stackoverflow.com Sep 18 '12 at 20:59

This question came from our site for professional and enthusiast programmers.

add comment

6 Answers

up vote 15 down vote accepted

The SSLRequireSSL directive is what you're looking for, for example:

<Directory /topsecret>
  SSLRequireSSL
</Directory>
share|improve this answer
    
Thanks, that did the trick nice and easily. –  DrStalker Sep 19 '08 at 1:35
    
Welcome to Server Fault! We really do prefer that answers have content, not pointers to content. This may theoretically answer the question however, it would be preferable to include the essential parts of the answer here, and provide the link for reference. Thank you! –  Chris S Apr 11 '13 at 18:41
1  
Ok, I've updated my five-year-old post with an example :) –  Thomas Jul 1 '13 at 17:55
add comment

Assuming you are using VirtualHost directives,

Place a Directory directive in the non-ssl virtualhost denying access.

Then, place a Directory directive in the ssl virtualhost granting access.

share|improve this answer
add comment

I've always done this mod_rewrite in an .htaccess file, though you should be able to do it within your main config file as well.

Here's a guide with a few ways of making this happen: Smart HTTP and HTTPS RewriteRule Redirects

share|improve this answer
add comment

In the global configuration you could use:

<IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteCond %{HTTPS} !on
   RewriteRule .* https://%{HTTP_HOST}/%{REQUEST_URI} [R=301,L,QSA]
</IfModule>

Similarly you could use a .htaccess file in the first directory of the secure directory tree:

<IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteCond %{HTTPS} !on
   RewriteRule .* https://%{HTTP_HOST}/%{REQUEST_URI} [R=301,L,QSA]
</IfModule>

That last one could also be placed inside a directory directive in the global or virtual host configuration.

share|improve this answer
add comment

Alternatively, you could use the server-side language to do the processing for you, rather than using Apache's configuration options (if, perhaps, you don't have access to the server's configuration).

For example, with PHP:

if (!isset($_SERVER['HTTPS'])) {
  // put your redirect here
  header('Location: http://myserver.com/public');
}

(though just be aware - if you're using ISAPI on Microsoft IIS, if the request is not being routed through HTTPS, then the value of the $_SERVER['HTTPS'] variable will be "off")

share|improve this answer
add comment

maybe even:if($_SERVER['SERVER_PORT'] != 443){ header('Location:http://publicdomain.com'); }

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.