5

I have a server running Debian 10. It runs Apache 2.4 for a a web services accessible under https://example.com, thanks to a LetsEncrypt certificate.

But it also runs an app (Subsonic) which serves a web UI on port 4040, under its own webserver, as I have no vhost for it and as it is still accessible when Apache is stopped. So for now the app is accessible under HTTP on http://example.com:4040.

I know how to add SSL support for an Apache vhost, but how can I add HTTPS support for it this app, so that it is accessible on https://example.com:4040 or https://example.com:1234?

Also, should I use a different SSL certificate than the one I already have for this domain?

Improve this question

1 Answer 1

Reset to default
11

Add a reverse proxy in front of the app and configure HTTPS on this proxy. Conveniently, you have Apache running which can happily reverse proxy for you.

As it currently stands, you can't use port 4040 as that's already taken by the app, so unless you can change the app's port or get it to bind to localhost (127.0.0.1 etc) only, then you'll have to run this app on a different port. On that note, if you want to run this app over HTTPS there's no point leaving it still accessible by the insecure HTTP, so it would be better to configure this app to bind to localhost and have it accessible only through the reverse proxy.

You need the ProxyPass family of configuration options to create a reverse proxy. Here's an incomplete example:

Listen <Public IP address of server>:4040

<VirtualHost *:4040>

  Protocols h2 h2c http/1.1
  ServerName example.com

  SSLEngine On

  # LetsEncrypt certificates (if not configured in another file)
  #  SSLCertificateFile    /etc/letsencrypt/live/example.com/fullchain.pem
  #  SSLCertificateKeyFile /etc/letsencrypt/live/eample.com/privkey.pem
  #  Include               /etc/letsencrypt/options-ssl-apache.conf

  ProxyPreserveHost On
  ProxyRequests Off
  ProxyPass / http://127.0.0.1:4040/
  ProxyPassReverse / http://127.0.0.1:4040/

</VirtualHost>

Certificates need to have the hostname that the client uses to connect embedded within their Subject Alternative Names extension, therefore as you don't seem to be proposing a different host (example.com in both cases) you won't need a new certificate.

Improve this answer
6
  • Thanks, reverse proxy with existing Apache is indeed what I need! One last thing, I'm still a bit confused about "binding to localhost". Does that mean the app wouldn't listen to external network anymore? Also, on your example, 4040 would be the external HTTPS port, right?
    – bolino
    Jun 25, 2020 at 15:04
  • 5
    Yes on both counts. The app only listens locally and any external traffic hits the proxy on port 4040 before it forwards it to the app. It can do this as the proxy is local too.
    – garethTheRed
    Jun 25, 2020 at 15:20
  • Got it. One last thing, do those virtualhost config lines have to be added to the existing virtual host config file for HTTPS, like example.com-le-ssl.conf?
    – bolino
    Jun 25, 2020 at 15:25
  • 1
    You can either add them to an existing config or create another. Just check how any other ones are enabled in your distro though.
    – garethTheRed
    Jun 25, 2020 at 15:54
  • 1
    Apologies - the listen directive is in the server config context, not virtual host. Some distros have their listen directive in a separate file, such as ports.conf.
    – garethTheRed
    Jun 28, 2020 at 9:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.