0

I have an Apache that serves an application as well as a web service. I want the web service over https but the application over http. How do I enable SSL on only a certain location? None of the SSL directives seem to be valid inside a

<Location> </Location>

Currently I have

<IfModule ssl_module>
        ServerName www.myserver.com
        SSLEngine on
        SSLCACertificateFile "/usr1/apache/conf/ssl/CAList.pem"
        SSLCertificateFile "/usr1/apache/conf/ssl/mine.crt"
        SSLCertificateKeyFile "/usr1/apache/conf/ssl/mine.pem"
        SSLVerifyClient require
</IfModule>

But this enables ssl on the pages I dont want ssl.

  • 2
    Why would you go to the effort of setting up TLS and then intentionally disable it for some locations? – EEAA May 12 '16 at 1:23
2

HTTPS needs to be set up at the vhost level since it uses a different port (port 443 versus port 80 for HTTP).

So you have to set up HTTPS for the whole site.

What you can do is force HTTPS (or even HTTP) for certain URLs using Redirect (for one page), RedirectMatch (for multiple pages that match a pattern) or Rewrite (for more complex queries that include or exclude certain conditions).

So if someone went to http://www.example.com/login then you can redirect that to https://www.example.com/login.

You can also redirect back so if someone went to https://www.example.com/normal-page then you redirect back to http. Note to do that the visitor will need to go through the full https connection negotiation as a redirect is the same as a normal page in that it is returned after the https session is set up.

The internet is quickly moving to a fully HTTPS world. There are numerous benefits to using HTTPS on your whole site and it massively reduces complexity compared to a mixed site. Certain features (e.g. getting location from browser) will only work over HTTPS in Chrome for example and this will only increase. HTTP/2 will only work over HTTPS on all browsers as another example.

At the same time the downsides of HTTPS are almost non-existent if you are having some of your site on HTTPS (so have to actually set up HTTPS which can be complex and so main downside). Yes there's a small impact to initial load time but after that, with proper set up, there is almost no noticeable performance impact unless running on truly ancient hardware or serving massive files.

If going through the hassle of setting up HTTPS I would strongest advise to use it everywhere like EEAA suggested.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.