Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an Apache web site, with certain portions powered by JBoss. The question is, how can we get Apache to force all HTTP requests to be re-directed to the HTTPS equivalent?

On our old server (CentOS 4, Apache 2.0, mod_jk), we have the following configuration:

Redirect /

This works great -- any requests to a PHP, vanilla HTML, or JBoss-powered web page get re-directed. However, on our new server (CentOS 5, Apache 2.2, mod_proxy_ajp), the same configuration only works for vanilla pages -- not for anything being sent to JBoss using AJP.

I also tried the following, which I found at

<Proxy *>
    RewriteEngine on
    RewriteCond %{SERVER_PORT} !^443$
    RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

But still no luck. I feel like I'm missing something obvious. Any help?

P.S. I am not in any way an Apache expert. I apologize if this turns out to be a beginner question :-P.

share|improve this question
up vote 8 down vote accepted

If I understand you correctly, you want to upgrade all http requests to https. If this is correct try this

<VirtualHost ip:80>

   RedirectMatch permanent ^(.*)$$1

<VirtualHost ip:443>

   Include vhosts.d/includes/ssl.conf

   # assumes you want to proxy everything on this vhost to jboss:8009
   <Location / >
       ProxyPass ajp://jboss:8009/
share|improve this answer
Thanks Dave. This did work, but it's very, very ugly (IMHO). I had to move all the content of proxy_ajp.conf into ssl.conf, and it seems like something is still "wrong". I don't get why none of this was necessary using Apache 2.0 and mod_jk. Still, most of all I'm glad it's working, so thanks again! – Matt Solnit May 11 '09 at 5:13
Ugly ? IMHO ProxyPass ajp:// is much nicer than the redirectionfest of trying to configure mod_jk. – Dave Cheney May 11 '09 at 6:50
Sorry if that came out the wrong way. It just seems weird to have to combine the two configuration files. Imagine having to do the same thing with php.conf, perl.conf, python.conf, webalizer.conf, etc. You would end up with one gigantic ssl.conf when it was really intended to just hold SSL-specific information. – Matt Solnit May 12 '09 at 4:11
Ahh, I see. Yes, duplicating the ssl conf in all your vhosts would be a fail. I'll update the answer to give a cleaner solution – Dave Cheney May 12 '09 at 6:25

This sintax will redirect to HTTPS keeping the same host and URL:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Sometimes you only want to redirect a directory, i.e. an adminstration area:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^/admin(|/.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
share|improve this answer

The more efficient syntax for ssl redirection is using the apache env var HTTPS

You do like this:

Host rewriting

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .*{REQUEST_URI} [R,L]

Without host rewriting

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

In regards to mod_jk vs apache2.2 ajp proxy I use mod_jk just because I find JkMount and JkUnMount to be useful when you need to separate static and dynamic content, I'd say is more straightforward. The way I structure my configurations is with conditional including for ssl. So I have one httpd.conf for each host, I have a dir for each conf include the following way:


ServerRoot /etc/httpd
LoadModule jk_module modules/
LoadModule ssl_module/
Include conf/test_com/*.conf


<IfModule jk_module>
JkWorkersFile conf/test_conf/

JkLogFile logs/test_conf/mod_jk.log 

JkLogLevel error

JkLogStampFormat "[%a %b %d %H:%M:%S %Y]"

JkRequestLogFormat "%w %V %T"

RewriteEngine on
RewriteRule .* - [F] 

JkMount /* loadbalancer
JkUnMount /error* loadbalancer

JkShmFile run/jk.shm

<Location /jkstatus/>
JkMount status
Order deny,allow
Deny from all
Allow from








<IfModule ssl_module>

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]


DocumentRoot "/var/www/"
SSLEngine on
SSLProtocol all -SSLv2 

SSLCertificateFile "conf/test_conf/ssl/test_com.crt"
SSLCertificateKeyFile "conf/test_conf/ssl/test_com.key"
SSLCACertificateFile "conf/test_conf/ssl/VerisignIntermediate.crt"

BrowserMatch ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

JkMount /* loadbalancer
JkUnMount /error* loadbalancer

JkStripSession On

share|improve this answer

However you solve it, can I suggest putting the directive SSLRequireSSL in the locations you want to be SSL only. That way if there's a config error later in the process, nothing is exposed over a non-SSL connection.

share|improve this answer
Wouldn't this eliminate the ability to send a re-direct to the browser? – Matt Solnit May 12 '09 at 22:14
If the redirect is in the <VirtualHost ip:80> definition, then that would fire and redirect. The <Location> inside the <VirtualHost ip:443> would only be picked up after the redirect, and so the SSLRequireSSL would just make sure that there's not been a later config error that has removed SSL from ip:443. The directives will also fire in sequence, so the redirect will be acted on before SSLRequireSSL anyway (as long as you put them in that order). SSLRequireSSL is a belt-and-braces catch. – CK. May 13 '09 at 9:30
I see. Thank you very much. – Matt Solnit May 13 '09 at 21:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.