2

Our network ops folks have set up SSL termination, then reverse-proxy the request to us. Their requirement is that, if they saw the input on port 443, we must serve the content on port 443, so we are serving unencrypted content on port 443. That is an invariant that we have to work around.

For the most part, this isn't a problem. We Listen 443 and don't set up SSL, and things work, except...redirects.

As an example, if we define:

Alias /foo /path/to/foo
<Directory /path/to/foo>
    ...
</Directory>

Apache is smart enough to redirect a request to /foo to /foo/. When we are using http on port 80, it works great. However, when the client is using https on port 443, we end up with a redirect with a Location that looks like this:

Location: http://my.example.com:443/foo/

The problem is we don't want to redirect from a secure to an insecure protocol, not that it matters, since we don't serve insecure content on port 443.

I'm guessing that there's a better way to tell Apache that this request was originally a secure request, but I don't know Apache config very well. I'm hoping I don't have to manually create a redirect for each Directory entry, especially since some content is available in both secure and insecure forms.

Anybody have any pointers to docs that can help (unfortunately, I can't come up with the right google incantation to help)? Pointers of the best way to handle this also appreciated. :)

Improve this question
1
  • You. Could do client --> https --> reverse proxy or load balancer with SSL termination --> new HTTPS --> web server ( with self signed certificate ). I.e. Also Ssl on your internal connection. That allows content inspection at the loadbalancer / reverse proxy and will prevent protocol mismatches
    – HBruijn
    Feb 25, 2015 at 23:11

1 Answer 1

Reset to default
5

This scenario is described in the documentation for ServerName:

Sometimes, the server runs behind a device that processes SSL, such as a reverse proxy, load balancer or SSL offload appliance. When this is the case, specify the https:// scheme and the port number to which the clients connect in the ServerName directive to make sure that the server generates the correct self-referential URLs.

If you want to do this and keep port 80 working at the same time, you'll have to use a VirtualHost for at least one of them, so you can add a separate ServerName.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .