0

I was asked to upgrade a server running Apache and Tomcat-6 on Debian Wheezy from HTTP to HTTPS. I have successfully obtained and install SSL certificates on the Apache part and checked that they work (using two different SSL checkers).

Next, I have added the following block to /etc/apache2/sites-available/default-ssl:

<VirtualHost *:80>
    ServerName server.name
    Redirect permanent / https://server.name/
</VirtualHost>

and this to the end of the <VirtualHost _default_:443> block in the same file:

ProxyRequests Off
ProxyPreserveHost On
ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/

On the Tomcat side, the /etc/tomcat6/server.xml file includes two active connectors:

<Connector port="8080" protocol="HTTP/1.1" 
           connectionTimeout="20000" 
           URIEncoding="UTF-8"
           redirectPort="8443" />

<Connector address="127.0.0.1" port="8009" protocol="AJP/1.3" redirectPort="8443" />

Now, when I go to https://server.name/app/main/login.jspx, I get an SSL connection, but it disappears after login.
If I go to https://server.name/app, I am immediately redirected to http://server.name/app/main/login.jspx (no SSL).
(And if I go to just https://server.name/, I end up on a redirect page defined in /var/lib/tomcat6/webapps/ROOT/index.html.)

What am I doing wrong? Do I need to use the AJP proxy instead?

  • 1
    Try add scheme="https" proxyName="server.name" proxyPort="443" secure="true" in you http connector (8080). – Federico Sierra May 2 '16 at 12:58
  • @FedericoSierra Thanks. This helped for the case where I connect explicitely via https, i.e., it stays as https. But the redirect from http to https still does not work. – Michal Kaut May 2 '16 at 13:50
  • Try add the redirect in /etc/apache2/sites-available/000-default.conf – Federico Sierra May 2 '16 at 14:13
  • @FedericoSierra Thanks, that did the trick :-). (I moved the *.8-related part (actually, only the Redirect line) from /etc/apache2/sites-available/default-ssl to /etc/apache2/sites-available/default and now it works. If you post it as an answer, I will accept it. – Michal Kaut May 3 '16 at 6:47
  • One more thing: I guess I should now use iptables to drop all connections to 8080 from outside of localhost, correct? And should I drop also outgoing? – Michal Kaut May 3 '16 at 6:50
3

If this Connector is being used in a proxy configuration, configure proxyName, proxyPort.

<Connector port="8080" protocol="HTTP/1.1" 
           connectionTimeout="20000" 
           URIEncoding="UTF-8"
           redirectPort="8443"
           scheme="https" 
           proxyName="server.name" 
           proxyPort="443" 
           secure="true" />

You will also need to set the scheme and secure attributes to the values https and true respectively for a https proxy.

For redirect http to https in apache server, try add directives in default config /etc/apache2/sites-available/000-default.conf.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.