We have an Apache web site, with certain portions powered by JBoss. The question is, how can we get Apache to force all HTTP requests to be re-directed to the HTTPS equivalent?

On our old server (CentOS 4, Apache 2.0, mod_jk), we have the following configuration:

Redirect / https://www.foo.com/

This works great -- any requests to a PHP, vanilla HTML, or JBoss-powered web page get re-directed. However, on our new server (CentOS 5, Apache 2.2, mod_proxy_ajp), the same configuration only works for vanilla pages -- not for anything being sent to JBoss using AJP.

I also tried the following, which I found at http://www.webmasterworld.com/apache/3050511.htm:

<Proxy *>
    RewriteEngine on
    RewriteCond %{SERVER_PORT} !^443$
    RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

But still no luck. I feel like I'm missing something obvious. Any help?

P.S. I am not in any way an Apache expert. I apologize if this turns out to be a beginner question :-P.

4 Answers 4


If I understand you correctly, you want to upgrade all http requests to https. If this is correct try this

<VirtualHost ip:80>
   ServerName www.company.com

   RedirectMatch permanent ^(.*)$ https://www.company.com$1

<VirtualHost ip:443>
   ServerName www.company.com

   Include vhosts.d/includes/ssl.conf

   # assumes you want to proxy everything on this vhost to jboss:8009
   <Location / >
       ProxyPass ajp://jboss:8009/
  • Thanks Dave. This did work, but it's very, very ugly (IMHO). I had to move all the content of proxy_ajp.conf into ssl.conf, and it seems like something is still "wrong". I don't get why none of this was necessary using Apache 2.0 and mod_jk. Still, most of all I'm glad it's working, so thanks again! May 11, 2009 at 5:13
  • Ugly ? IMHO ProxyPass ajp:// is much nicer than the redirectionfest of trying to configure mod_jk. May 11, 2009 at 6:50
  • Sorry if that came out the wrong way. It just seems weird to have to combine the two configuration files. Imagine having to do the same thing with php.conf, perl.conf, python.conf, webalizer.conf, etc. You would end up with one gigantic ssl.conf when it was really intended to just hold SSL-specific information. May 12, 2009 at 4:11
  • Ahh, I see. Yes, duplicating the ssl conf in all your vhosts would be a fail. I'll update the answer to give a cleaner solution May 12, 2009 at 6:25

This syntax will redirect to HTTPS keeping the host and URL same:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Sometimes you only want to redirect a directory, i.e. an adminstration area:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^/admin(|/.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

However you solve it, can I suggest putting the directive SSLRequireSSL in the locations you want to be SSL only. That way if there's a config error later in the process, nothing is exposed over a non-SSL connection.

  • Wouldn't this eliminate the ability to send a re-direct to the browser? May 12, 2009 at 22:14
  • If the redirect is in the <VirtualHost ip:80> definition, then that would fire and redirect. The <Location> inside the <VirtualHost ip:443> would only be picked up after the redirect, and so the SSLRequireSSL would just make sure that there's not been a later config error that has removed SSL from ip:443. The directives will also fire in sequence, so the redirect will be acted on before SSLRequireSSL anyway (as long as you put them in that order). SSLRequireSSL is a belt-and-braces catch.
    – CK.
    May 13, 2009 at 9:30

The more efficient syntax for ssl redirection is using the apache env var HTTPS

You do like this:

Host rewriting

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://yourhost.com%{REQUEST_URI} [R,L]

Without host rewriting

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

In regards to mod_jk vs apache2.2 ajp proxy I use mod_jk just because I find JkMount and JkUnMount to be useful when you need to separate static and dynamic content, I'd say is more straightforward. The way I structure my configurations is with conditional including for ssl. So I have one httpd.conf for each host, I have a dir for each conf include the following way:


SeverName test.com
ServerRoot /etc/httpd
LoadModule jk_module modules/mod_jk.so
LoadModule ssl_module/mod_ssl.so
Include conf/test_com/*.conf


<IfModule jk_module>
JkWorkersFile conf/test_conf/workers.properties

JkLogFile logs/test_conf/mod_jk.log 

JkLogLevel error

JkLogStampFormat "[%a %b %d %H:%M:%S %Y]"

JkRequestLogFormat "%w %V %T"

RewriteEngine on
RewriteRule .* - [F] 

JkMount /* loadbalancer
JkUnMount /error* loadbalancer

JkShmFile run/jk.shm

<Location /jkstatus/>
JkMount status
Order deny,allow
Deny from all
Allow from








<IfModule ssl_module>

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]


DocumentRoot "/var/www/test.com/htdocs"
ServerName test.com
SSLEngine on
SSLProtocol all -SSLv2 

SSLCertificateFile "conf/test_conf/ssl/test_com.crt"
SSLCertificateKeyFile "conf/test_conf/ssl/test_com.key"
SSLCACertificateFile "conf/test_conf/ssl/VerisignIntermediate.crt"

BrowserMatch ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

JkMount /* loadbalancer
JkUnMount /error* loadbalancer

JkStripSession On


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.