Redirect port 443 to port 80 at a firewall?

Question

I recently ran into a situation in which a web server I was running could no longer serve HTTPS traffic (due to some SSL cert issues). Since the server could not process this traffic I could not use Apache redirect rules to redirect to non-https. I then tried redirecting X.X.X.X:443 to X.X.X.X:80 at my firewall/NAT device but couldn't seem to get it to work.

I'm not asking how to do this since it is specific to my infrastructure and devices. But is it possible to do this at all? A colleague suggested it may not be possible since the client is requesting a secure connection, and it was failing because we were responding with an insecure connection. This would be different than responding with a 302 and forcing the client to make a new request for non-https using apache redirects.

Answer 1

Nope. Redirecting port 443 to 80 on firewall will just redirect it. Clients will expect that something SSL-enabled will be answering, and they will get plain HTTP answer instead. This will lead to an error (for example, ssl_error_rx_record_too_long).

Thing you are referring to is called SSL Offloading. It's when something (basically a HTTPS-enabled web server) is offloading SSL/TLS from a HTTPS stream and makes HTTP from it, then passes it to a HTTP web server, acting as a proxy.

Clearly the offloader should not have any issues with any certificates.

Answer 2

If you could tacitly downgrade a HTTPS connection, you could easily perform a MITM attack, so that kind of behaviour would be undesirable anyway.

Also, the SSL connection needs to be established before your web server can even know what to with the request, since the request itself is already sent encrypted, given that the request data can be at least as sensitive as the response (cleartext credentials. login cookies. posted content....)