How to make Apache port 80 secure?

Question

I have apache server on a remote VPS. I have only port 80 and 443 open. I currently use port 443 for SSH and 80 for HTTP.

I want to make port 80 to use HTTPS not HTTP. All the solutions I saw was to redirect HTTP to HTTPS like this:

Redirect permanent / https://mywebsite.com/

but I don't think that this will work.

Answer 1

It won't work if you keep ssh on port 443, but if you move this to yet another port, it would work.

Of course you could configure Apache to use HTTPS on port 80, but this would mean that your users would have to explicitly specify the port to use, like https://www.example.com:80/yourfile.html because normally the browser would expect to talk http on port 80 and https on port 443. Also, users could run into problems with firewalls which make the same assumption and block https on port 80.

Answer 2

Change your SSH port to something else. Honestly, I keep mine at the default 22 - I find no reason to change this, even though lots of people recommend changing it. It does make it hard[er] to figure out the SSH port if you change it, but it's not impossible.

Additionally, you need to serve Apache on 80 (http) and Apache SSL on 443 (HTTPS). If you want to force redirection of HTTP -> HTTPS by setting up a redirect on the Apache side, however, if you aren't trying to force http->https, you just need to make sure that SSL is configured and enabled on Apache (no redirect required if you aren't forcing http -> https).

Default Ports:

22 -> SSH
80 -> HTTP
443 -> HTTPS

Recommendation:
Never set a service to use a well known port of another service.

Answer 3

Just set up a virtual host to handle all the incoming request from port 80. Like this:

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile      /etc/apache2/pathtocert/Cert
    SSLCertificateKeyFile   /etc/apache2/pathtoprivateKey/Privk

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Although this will break incoming HTTP requests, it serves your purpose of making port 80 secure (by making anyone who tend to access it insecurely unable to do so).

Note: The redirection method will still expose your users to MITM attack.