Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have an Apache web site, with certain portions powered by JBoss. The question is, how can we get Apache to force all HTTP requests to be re-directed to the HTTPS equivalent?

On our old server (CentOS 4, Apache 2.0, mod_jk), we have the following configuration:

<VirtualHost 1.2.3.4:80>
Redirect / https://www.foo.com/
</VirtualHost>

This works great -- any requests to a PHP, vanilla HTML, or JBoss-powered web page get re-directed. However, on our new server (CentOS 5, Apache 2.2, mod_proxy_ajp), the same configuration only works for vanilla pages -- not for anything being sent to JBoss using AJP.

I also tried the following, which I found at http://www.webmasterworld.com/apache/3050511.htm:

<Proxy *>
    RewriteEngine on
    RewriteCond %{SERVER_PORT} !^443$
    RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]
</Proxy>

But still no luck. I feel like I'm missing something obvious. Any help?

P.S. I am not in any way an Apache expert. I apologize if this turns out to be a beginner question :-P.

share|improve this question
add comment

4 Answers

up vote 7 down vote accepted

If I understand you correctly, you want to upgrade all http requests to https. If this is correct try this

<VirtualHost ip:80>
   ServerName www.company.com

   RedirectMatch permanent ^(.*)$ https://www.company.com$1
</VirtualHost>

<VirtualHost ip:443>
   ServerName www.company.com

   Include vhosts.d/includes/ssl.conf

   # assumes you want to proxy everything on this vhost to jboss:8009
   <Location / >
       ProxyPass ajp://jboss:8009/
   </Location>
</Location>
share|improve this answer
    
Thanks Dave. This did work, but it's very, very ugly (IMHO). I had to move all the content of proxy_ajp.conf into ssl.conf, and it seems like something is still "wrong". I don't get why none of this was necessary using Apache 2.0 and mod_jk. Still, most of all I'm glad it's working, so thanks again! –  Matt Solnit May 11 '09 at 5:13
    
Ugly ? IMHO ProxyPass ajp:// is much nicer than the redirectionfest of trying to configure mod_jk. –  Dave Cheney May 11 '09 at 6:50
    
Sorry if that came out the wrong way. It just seems weird to have to combine the two configuration files. Imagine having to do the same thing with php.conf, perl.conf, python.conf, webalizer.conf, etc. You would end up with one gigantic ssl.conf when it was really intended to just hold SSL-specific information. –  Matt Solnit May 12 '09 at 4:11
    
Ahh, I see. Yes, duplicating the ssl conf in all your vhosts would be a fail. I'll update the answer to give a cleaner solution –  Dave Cheney May 12 '09 at 6:25
add comment

This sintax will redirect to HTTPS keeping the same host and URL:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Sometimes you only want to redirect a directory, i.e. an adminstration area:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^/admin(|/.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
share|improve this answer
add comment

The more efficient syntax for ssl redirection is using the apache env var HTTPS

You do like this:

Host rewriting

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://yourhost.com%{REQUEST_URI} [R,L]

Without host rewriting

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

In regards to mod_jk vs apache2.2 ajp proxy I use mod_jk just because I find JkMount and JkUnMount to be useful when you need to separate static and dynamic content, I'd say is more straightforward. The way I structure my configurations is with conditional including for ssl. So I have one httpd.conf for each host, I have a dir for each conf include the following way:

/etc/httpd/test_conf.httdp.conf:

SeverName test.com
ServerRoot /etc/httpd
LoadModule jk_module modules/mod_jk.so
LoadModule ssl_module/mod_ssl.so
(snip)
Include conf/test_com/*.conf

/etc/httpd/test_conf/mod_jk.conf

<IfModule jk_module>
JkWorkersFile conf/test_conf/workers.properties

JkLogFile logs/test_conf/mod_jk.log 

JkLogLevel error

JkLogStampFormat "[%a %b %d %H:%M:%S %Y]"

JkRequestLogFormat "%w %V %T"

RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(PUT|DELETE|TRACK|OPTIONS|TRACE)
RewriteRule .* - [F] 

JkMount /* loadbalancer
JkUnMount /error* loadbalancer

JkShmFile run/jk.shm

<Location /jkstatus/>
JkMount status
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Location>

</IfModule>

/etc/httpd/conf/test_conf/workers.properties

worker.list=loadbalancer,status

worker.node1.port=8009
worker.node1.host=192.168.1.100
worker.node1.type=ajp13
worker.node1.lbfactor=2
worker.node1.ping_mode=A
worker.node1.connect_timeout=10000
worker.node1.prepost_timeout=10000
worker.node1.socket_timeout=90
worker.node1.connection_pool_timeout=600
worker.node1.method=R
worker.node1.fail_on_status=500,501,502,503

worker.node2.reference=worker.node1
worker.node2.host=192.168.1.200

worker.loadbalancer.type=lb
worker.loadbalancer.balance_workers=node1,node2
worker.loadbalancer.sticky_session=true
worker.status.type=status

/etc/httpd/conf/test_conf/httpd-ssl.conf

<IfModule ssl_module>
Listen 192.200.10.100:443

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

(snip)
<VirtualHost 192.200.10.100:443>

DocumentRoot "/var/www/test.com/htdocs"
ServerName test.com
(snip)
SSLEngine on
SSLProtocol all -SSLv2 
SSLCipherSuite DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA

SSLCertificateFile "conf/test_conf/ssl/test_com.crt"
SSLCertificateKeyFile "conf/test_conf/ssl/test_com.key"
SSLCACertificateFile "conf/test_conf/ssl/VerisignIntermediate.crt"


BrowserMatch ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

JkMount /* loadbalancer
JkUnMount /error* loadbalancer

JkStripSession On

</VirtualHost>
</IfModule>
share|improve this answer
add comment

However you solve it, can I suggest putting the directive SSLRequireSSL in the locations you want to be SSL only. That way if there's a config error later in the process, nothing is exposed over a non-SSL connection.

share|improve this answer
    
Wouldn't this eliminate the ability to send a re-direct to the browser? –  Matt Solnit May 12 '09 at 22:14
    
If the redirect is in the <VirtualHost ip:80> definition, then that would fire and redirect. The <Location> inside the <VirtualHost ip:443> would only be picked up after the redirect, and so the SSLRequireSSL would just make sure that there's not been a later config error that has removed SSL from ip:443. The directives will also fire in sequence, so the redirect will be acted on before SSLRequireSSL anyway (as long as you put them in that order). SSLRequireSSL is a belt-and-braces catch. –  CK. May 13 '09 at 9:30
    
I see. Thank you very much. –  Matt Solnit May 13 '09 at 21:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.