On my development server, log in is with a certificate only (HTTPS on 443), While HTTP on 80 is redirecting to HTTPS. Without the redirect the ACCESS IS NOT RESTRICTED and everyone can go everywhere, because i can't do "require" on the HTTP and not HTTPS because "require" works only on LOCATION/FILE not on VHOST.
Can redirect be trusted to always deny access to HTTP? Is it secure enough?
Relevant settings:
At location /var/www/html/:
Require All granted
Options Indexes FollowSymLinks
At vhost [server ip]:80
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]
At vhost [server ip]:433
SSLVerifyClient require