How do I force Apache to use HTTPS in conjunction with AJP?

Question

We have an Apache web site, with certain portions powered by JBoss. The question is, how can we get Apache to force all HTTP requests to be re-directed to the HTTPS equivalent?

On our old server (CentOS 4, Apache 2.0, mod_jk), we have the following configuration:

<VirtualHost 1.2.3.4:80>
Redirect / https://www.foo.com/
</VirtualHost>

This works great -- any requests to a PHP, vanilla HTML, or JBoss-powered web page get re-directed. However, on our new server (CentOS 5, Apache 2.2, mod_proxy_ajp), the same configuration only works for vanilla pages -- not for anything being sent to JBoss using AJP.

I also tried the following, which I found at http://www.webmasterworld.com/apache/3050511.htm:

<Proxy *>
    RewriteEngine on
    RewriteCond %{SERVER_PORT} !^443$
    RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]
</Proxy>

But still no luck. I feel like I'm missing something obvious. Any help?

P.S. I am not in any way an Apache expert. I apologize if this turns out to be a beginner question :-P.

Answer 1

If I understand you correctly, you want to upgrade all http requests to https. If this is correct try this

<VirtualHost ip:80>
   ServerName www.company.com

   RedirectMatch permanent ^(.*)$ https://www.company.com$1
</VirtualHost>

<VirtualHost ip:443>
   ServerName www.company.com

   Include vhosts.d/includes/ssl.conf

   # assumes you want to proxy everything on this vhost to jboss:8009
   <Location / >
       ProxyPass ajp://jboss:8009/
   </Location>
</VirtualHost>

Answer 2

This syntax will redirect to HTTPS keeping the host and URL same:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Sometimes you only want to redirect a directory, i.e. an adminstration area:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^/admin(|/.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Answer 3

However you solve it, can I suggest putting the directive SSLRequireSSL in the locations you want to be SSL only. That way if there's a config error later in the process, nothing is exposed over a non-SSL connection.

Answer 4

The more efficient syntax for ssl redirection is using the apache env var HTTPS

You do like this:

Host rewriting

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://yourhost.com%{REQUEST_URI} [R,L]

Without host rewriting

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

In regards to mod_jk vs apache2.2 ajp proxy I use mod_jk just because I find JkMount and JkUnMount to be useful when you need to separate static and dynamic content, I'd say is more straightforward. The way I structure my configurations is with conditional including for ssl. So I have one httpd.conf for each host, I have a dir for each conf include the following way:

/etc/httpd/test_conf.httdp.conf:

SeverName test.com
ServerRoot /etc/httpd
LoadModule jk_module modules/mod_jk.so
LoadModule ssl_module/mod_ssl.so
(snip)
Include conf/test_com/*.conf

/etc/httpd/test_conf/mod_jk.conf

<IfModule jk_module>
JkWorkersFile conf/test_conf/workers.properties

JkLogFile logs/test_conf/mod_jk.log 

JkLogLevel error

JkLogStampFormat "[%a %b %d %H:%M:%S %Y]"

JkRequestLogFormat "%w %V %T"

RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(PUT|DELETE|TRACK|OPTIONS|TRACE)
RewriteRule .* - [F] 

JkMount /* loadbalancer
JkUnMount /error* loadbalancer

JkShmFile run/jk.shm

<Location /jkstatus/>
JkMount status
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Location>

</IfModule>

/etc/httpd/conf/test_conf/workers.properties

worker.list=loadbalancer,status

worker.node1.port=8009
worker.node1.host=192.168.1.100
worker.node1.type=ajp13
worker.node1.lbfactor=2
worker.node1.ping_mode=A
worker.node1.connect_timeout=10000
worker.node1.prepost_timeout=10000
worker.node1.socket_timeout=90
worker.node1.connection_pool_timeout=600
worker.node1.method=R
worker.node1.fail_on_status=500,501,502,503

worker.node2.reference=worker.node1
worker.node2.host=192.168.1.200

worker.loadbalancer.type=lb
worker.loadbalancer.balance_workers=node1,node2
worker.loadbalancer.sticky_session=true
worker.status.type=status

/etc/httpd/conf/test_conf/httpd-ssl.conf

<IfModule ssl_module>
Listen 192.200.10.100:443

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

(snip)
<VirtualHost 192.200.10.100:443>

DocumentRoot "/var/www/test.com/htdocs"
ServerName test.com
(snip)
SSLEngine on
SSLProtocol all -SSLv2 
SSLCipherSuite DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA

SSLCertificateFile "conf/test_conf/ssl/test_com.crt"
SSLCertificateKeyFile "conf/test_conf/ssl/test_com.key"
SSLCACertificateFile "conf/test_conf/ssl/VerisignIntermediate.crt"


BrowserMatch ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

JkMount /* loadbalancer
JkUnMount /error* loadbalancer

JkStripSession On

</VirtualHost>
</IfModule>