3

I have a LAMP webserver, and on it there is https://sslhosting.cz/ domain.

First I attach a general Let's Encrypt config file, which I changed to my needs:

/etc/letsencrypt/options-ssl-apache.conf

# Baseline setting to Include for all Let's Encrypt SSL sites


SSLEngine               on


# Intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3
SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDH$
SSLHonorCipherOrder     on
SSLCompression          off
SSLOptions              +StrictRequire


# Add vhost name to log entries:
LogFormat               "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat               "%v %h %l %u %t \"%r\" %>s %b" vhost_common


#CustomLog              /var/log/apache2/access.log vhost_combined
#LogLevel               warn
#ErrorLog               /var/log/apache2/error.log


# Always ensure Cookies have "Secure" set (JAH 2012/1)
#Header                 edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"


# HSTS = HTTP Strict Transport Security
Header                  always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" env=HTTPS
Header                  always set X-Frame-Options DENY


# OCSP Stapling
SSLCACertificateFile    /etc/apache2/certificates/letsencrypt-crosssigned-stapling.pem
SSLUseStapling          on

Do I need to have port 80 configured in Virtualhost for an HTTPS website? Note that I want HTTP to be redirected to HTTPS.

Follows the specific website config:

/etc/apache2/sites-available/sslhosting.cz-le-ssl.conf

<VirtualHost *:80>

  ServerName             sslhosting.cz
  ServerAlias            www.sslhosting.cz

  RewriteEngine          on

  RewriteCond            %{HTTPS} !on
  RewriteRule            ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L]

  RewriteCond           %{HTTP_HOST} ^www\.sslhosting\.cz
  RewriteRule           ^(.*)$ https://sslhosting.cz/$1 [R=301,L]

</VirtualHost>


<IfModule mod_ssl.c>

        <VirtualHost *:443>

                ServerAdmin     admin@vlastimilburian.cz

                ServerName      sslhosting.cz
                ServerAlias     www.sslhosting.cz

                DocumentRoot    /var/www/sslhosting.cz/public_html
                ErrorLog        ${APACHE_LOG_DIR}/error.log
                CustomLog       ${APACHE_LOG_DIR}/access.log combined

                SSLCertificateFile      /etc/letsencrypt/live/sslhosting.cz/fullchain.pem
                SSLCertificateKeyFile   /etc/letsencrypt/live/sslhosting.cz/privkey.pem

                Include         /etc/letsencrypt/options-ssl-apache.conf

        </VirtualHost>

        SSLStaplingCache        shmcb:/tmp/stapling_cache(128000)

</IfModule>

Now, the question:

Do I need to have port 80 configured in LAMP for an HTTPS website?

11

The answer to your titled question "Do I need to have port 80 configured in LAMP for an HTTPS website?" is no, you don't. You can run a LAMP stack on whatever port you would like. Common choices include 80,443 (SSL/TLS), 8080, 8000, etc.

Inside the question, you add a wrinkle which changes the answer a bit.

"Note that I want HTTP to be redirected to HTTPS."

If you want your webserver to do that redirection, and if you assume the standard http port 80/tcp, then the answer becomes yes. You need to have port 80 configured to complete the redirection.

For completeness sake, I can think of a few other ways to get to a working config that do not rely on port 80 on your webserver.

One is to use a load balancer out in front that would handle the redirection.

Two is to use iptables to redirect the port. Note, this won't quite handle the SSL/TLS requirement in your case.

  • 1
    Also Let's Encrypt needs port 80 open if you use the http-01 challenge. – zhenech Apr 14 '16 at 5:57
  • option 3 could be a rewrite rule Redirect "/" "https://example.com/" so you redirect everything from port 80 to 443 by the webserver itself – Koen van der Rijt Apr 14 '16 at 8:52
  • 3
    @KoenvanderRijt ... and how is the browser supposed to get the http-packet containing the redirect to port 443, if the server doesn't listen on port 80 in the first place? ;-) – s1lv3r Apr 14 '16 at 11:49
  • 4
    Also, If you're going to do an HTTP -> HTTPS redirection, you really should also have a look at HSTS, and implement the headers it requires. Recent browsers support that spec, and after one HTTP connection, they will always try to contact your site in HTTPS. – LordOfThePigs Apr 14 '16 at 12:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.