0

So I'm in a curious situation in that I am using a particular server to host things, which I can't host anywhere else (it has access to user databases etc which can't otherwise be accessed). I've been in quite a bit of discussion with the sysadmin at it looks like the only way to run our site: www.foo.com over https may be through some sort of proxy.

Currently, users go to www.foo.com and are redirected to https:// host-server.com/foo, as there is an SSL cert installed on that. I want users to be on https:// www.foo.com.

I'm told that for various reasons it's going to be very difficult to add an additional SSL cert to the host server.

So I was wondering if it is possible to have the DNS records point to a new server, which then creates the HTTPS connection with the browser. Then it forwards requests to https:// host-server.com/foo and feeds the replies back to the original requester.

Does this make sense? And would it be at all feasible? My experience with SSL is limited at best, so thanks in advance for your help :)

ps gaps in hyperlinks as ServerFault was getting unhappy with the number of links I was posting!

2 Answers 2

1

Regardless of the protocol (HTTP, HTTPS, ...) the hostname www.foo.com will always result in the same IP address(es). Which can offer HTTP (default port 80) and HTTPS (default port 443). So if it is not possible to use port 443 (for whatever reason) you have to move to a different IP address for both HTTP and HTTPS.

Non default port

As 'Frands Hansen' already mentioned you can use a non default port for HTTPS. But you will have to include this in all URLs (e.g. https://www.foo.com:1234/). This might be inappropriate.

HTTPS Reverse Proxy

If you want to or have to keep the HTTP Server as it is, you could consider placing the HTTPS on a separate hostname like https://secure.foo.com/. Which can be a SSL proxy like the https://host-server.com/foo in your example.

To do this you need a host that can be accessed by a public IP and TCP Port 443. On this machine you run a Webserver that answers all HTTPS requests. It will forward all requests to the existing HTTP Server and return the answer via the encrypted channel back to the client. You could use any common webserver for this like apache, nginx or lighttpd or a more specialized solution like pound. You should find a lot of examples how to do this. Keep in mind that all traffic between the HTTPS proxy and the HTTP webserver will be unencrypted by default.

Again, there is nothing wrong in doing HTTP and HTTPS on the same machine. It simply depends on the existing installation and requirements. Mainly the public IP and port to use and compatibility with SNI certificates on the client side.

4
  • Hi, Thanks for your comments. So Would you be able to elaborate on the third paragraph? That to me sounds like what I was thinking of.
    – penguin
    Sep 24, 2012 at 18:47
  • It is no problem at all to use the same hostname for SSL. His problem is not that. His problem is having several on the same IP address - and you cannot do that, not even with a different hostname. Sep 25, 2012 at 18:34
  • Ah but you talked about secure.foo.com which is an SSL proxy to host-server/foo This is precisely what I was thinking of; but how would I go about setting this up? This is where i get lost!! Many thanks for your help!
    – penguin
    Sep 27, 2012 at 0:00
  • @penguin I put some more details in the answer. I hope that brings you forward.
    – Roman
    Sep 29, 2012 at 8:41
1

The short answer is no.

You cannot do that. What you need to do is either getting an additional IP address for the server or put the site on another port than 443.

The last possibility is by using SNI - but I would advice you not to do that, since Windows Xp does not support it - and for some reason, a lot of people still use XP.

The only right solution is, to get another IP address for the server. This will make it possible. The reason for this is, that SSL binds on the port and that the encryption is negotiated before any data exchange - the host header is part of the data exchange.

1
  • Hey, thanks for your reply. I was afraid you were going to say that! Unfortunately we can't add additional IPs on the host server (real PITA!)
    – penguin
    Sep 24, 2012 at 18:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .