Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to force https and basic auth for server-status output (mod_status). If I enable auth and user asks for http://site/server-status apache first asks for pass, then redirects to httpS, then asks for pass again.

This question is similar to Apache - Redirect to https before AUTH and force https with apache before .htpasswd but I cannot get it work because we are speaking not about generic folder but Location structure.

My config (shortly) is as follows:

<Location /server-status>
    <IfModule mod_rewrite.c>
        RewriteEngine on
        RewriteBase /server-status
        RewriteCond %{HTTPS} off
                RewriteCond %{SERVER_PORT} 80
                RewriteRule ^ - [E=nossl]
                RewriteRule (.*) https://site/server-status} [R=301,L]

    SetHandler server-status
    Order deny,allow
    Deny from all
    Allow from localhost ip6-localhost
    Allow from

    Allow from env=nossl

    AuthUserFile /etc/httpd/status-htpasswd
    AuthName "Password protected"
    AuthType Basic
    Require valid-user

    Satisfy any

I assume Allow from env=nossl should allow everyone with RewriteCond %{HTTPS} off and server port 80, then force it to redirect but it does not work.

Please note, I do not want force to SSL the whole site but /server-status only. If it matters the server has several sites.

What am I doing wrong? Thank you.

share|improve this question
up vote 1 down vote accepted

Is there a way you can separate HTTP and HTTPS into two virtual hosts? You can put the Auth on only the HTTPS and have the HTTP redirect to HTTPS. The full configuration would look something like this.

<VirtualHost *:80>
Redirect /

<IfModule mod_ssl.c>
<VirtualHost *:443>
share|improve this answer

I didn't have much luck getting RewriteCond %{HTTPS} off working - instead, what worked for me was

RewriteCond    %{SERVER_PORT}   !443

Another suggestion (from this question) would be to move the Auth lines into a <VirtualHost *:443> section.

share|improve this answer
Have just tested: doesn't work. It asks for pass before redirect. – Putnik Nov 28 '12 at 16:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.