Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As title says,

I want to set my apache to listen on 443, and will configure SSL.

So, My Question is :-

1). Does that mean, i will not have port 80 or any other port which is no ssl ? 2). My site can only be accessed via https and no http ? Thanks

share|improve this question

3 Answers 3

up vote 4 down vote accepted

I would advice against doing this using an iptables redirect. The reason is that when someone browses your site using HTTP, their browser is not expecting an SSL session handshake. It may work, but it's definitely not guaranteed to.

Instead, I'd have a separate Apache instance (or a VirtualHost) that listens on port 80. That apache instance/VH should be configured to only issue a redirect to the SSL-enabled site, like this:

RedirectMatch /(.*) https://www.example.com/$1

That way the browser will understand that it's being sent off to an SSL site, and there will be no problem with the SSL negotiation.

share|improve this answer
1  
yup.. i tried with iptable and this was not working... thanks.. –  James Bond Jul 12 '13 at 10:49

If you configure apache with no listening configuration on port 80 and ensure that you configure it to listen on port 443 with ssl correctly then yes, your server will not listen on any non-ssl ports.

share|improve this answer
    
so, can i redirect all user browsing http with the help of iptable :- root@linux# iptables -t NAT -a PREROUTING -p tcp --dport 80 --to-port 443 -j REDIRECT –  James Bond Jul 12 '13 at 10:34
    
It wouldn't work. In your web browser you will see something like - "Your browser sent a request that this server could not understand. Reason: You're speaking plain HTTP to an SSL-enabled server port. Instead use the HTTPS scheme to access this URL, please." –  ALex_hha Jul 20 '13 at 18:31

You cannot redirect the HTTP requests to HTTPS without initializing the SSL connetion. So, iptables will not help you. You need to do that with your web server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.