We are using RHEL and we have to open one non-privileged and arbitrary port, say, port 12345, to an ordinary user. This ordinary user needs to run an HTTP service listening on this port and every computer within the LAN network can access the service. Given the nature of the service the user needs to run, reverse proxy is unlikely to work and the user's service has to directly listen on the port and serve its clients.
We want to force the user to secure its service with an SSL certificate but currently we don't have a good way to do so from a technical aspect. (Currently, all we do now is keep reminding the user to properly configure HTTPS himself.)
The question is, would it be possible for a sysadmin to force a port to serve HTTPS content only and suppose the user uses plain HTTP (either knowingly or unknowingly), the traffic will be blocked?
Usually I do this with a reverse proxy--internal services listen on localhost only and a dedicated HTTP server program such as Apache is used to handle the SSL part. This approach does not work easily this time since the web service is pretty complicated (I suppose it might work with some equally complicated rewrite rules) so I am wondering if there is another simpler approach.