You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Alessandro Fantuzzi <fa...@o-one.net> on 2009/03/30 22:15:54 UTC
[users@httpd] From https to http and vice versa
We have a site running on Apache and Tomcat
LINUX
APACHE 2.0.59
TOMCAT 5.5.20
JVM 1.5
We have to put some pages under SSL, just some, say:
https://www.site.com/public/subscribe.jsp
https://www.site.com/public/unsubscribe.jsp
We will install the 128 bit certificate under Apache Http server.
Path /public contains other pages but we want to put under SSL just the
ones mentioned before. Is this possible ?
Should we create two Vitrual hosts, one for port 80 and one for 443 ?
How do we force the user using the correct port, should we create
rewrite rules from one Virtual Host to the other ?
Thanks in advance
--
Alessandro Fantuzzi - O-one s.r.l.
E-mail: fantuzzi@o-one.net <ma...@o-one.net>
Software developer
www.o-one.net <http://www.o-one.net>
-------------------------------------------------------------------
Via Dante Zanichelli, 61 - 42100 Reggio Emilia
Tel. 0522 930078 - Fax. 0522 387947
-------------------------------------------------------------------
Via Stendhal, 36 - 20144 Milano
Tel 02.42292057 - Fax 02.47770936
-------------------------------------------------------------------
STRICTLY PERSONAL AND CONFIDENTIAL This message may contain confidential
and proprietary material for the sole use of the intended recipient. Any
review or distribution by others is strictly prohibited. If you are not
the intended recipient please contact the sender and delete all copies.
The contents of this message that do not relate to the official business
of our company shall be understood as neither given nor endorsed by it.
-------------------------------------------------------------------
Re: [users@httpd] From https to http and vice versa
Posted by Brian Mearns <me...@gmail.com>.
On Tue, Mar 31, 2009 at 10:19 AM, Alessandro Fantuzzi
<fa...@o-one.net> wrote:
>
> First of all thanks for your advice.
>
> I will check if we can serve all of the contents both in SSL and non SSL.
> I didnt consider that solution, in fact I was concerned about putting the
> conversation between client and server back to http when the user requires a
> page which needs no protection.
> After all the most important thing should be to ensure that some pages are
> served only in https and forget about the rest. In fact once the client has
> established a secure connection, the conversation should go on that way
> regardless of the pages requested, with no need to get back to http.
>
> Anyway I fear our client will not accept this solution, because it is not
> what they requested.
>
> The ideal solution should be to force the user to visit protected pages in
> https and get back to http for all the rest of the contents.
>
> Is there a way to accomplish this ?
>
> Do the protected pages need to be on a separate path or it is not necessary
> ?
>
> As regards the number of bits I was referring to 128 bit Verisign
> certificates.
>
> Bye
Should be pretty easy to do what you want:
Set up your SSL enabled virtual host to listen on 443. You can use the
same DocumentRoot, and all the same Alias and RewriteRules so that
both vhosts serve up the same content. For pages that require
protection, you can use RequireSSL directive to prevent the page from
being accessed over an insecure connection: if someone tries to access
it over http, it should give a 403 forbidden error. You can also use a
RewriteRule with the [R] flag in the non-secure vhost so that accesses
to the pages that require secure connections get redirected to the
secure connection. Something like:
RewriteRule ^/securepage.html https://myhost/securepage.html [R]
You can do the same thing if you want to prevent non-secure pages from
being served up by the SSL vhost, just use a RewriteRule to redirect
them to non-secure connection, but unless your client thinks they know
what they're doing but actually don't, then this shouldn't be
required. Links in the secure-page content can always be absolute and
specify non-secure destinations, so it's not like they'll
automatically just stay on secure HTTP once they get there.
Is that what you're looking for?
Regarding the size of the key: sorry, I've been working with PGP a lot
lately where 1024+ bits are the norm. I guess 128bit is pretty
standard for SSL.
-Brian
--
Feel free to contact me using PGP Encryption:
Key Id: 0x3AA70848
Available from: http://pgp.mit.edu/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] From https to http and vice versa
Posted by Alessandro Fantuzzi <fa...@o-one.net>.
First of all thanks for your advice.
I will check if we can serve all of the contents both in SSL and non SSL.
I didnt consider that solution, in fact I was concerned about putting
the conversation between client and server back to http when the user
requires a page which needs no protection.
After all the most important thing should be to ensure that some pages
are served only in https and forget about the rest. In fact once the
client has established a secure connection, the conversation should go
on that way regardless of the pages requested, with no need to get back
to http.
Anyway I fear our client will not accept this solution, because it is
not what they requested.
The ideal solution should be to force the user to visit protected pages
in https and get back to http for all the rest of the contents.
Is there a way to accomplish this ?
Do the protected pages need to be on a separate path or it is not necessary ?
As regards the number of bits I was referring to 128 bit Verisign
certificates.
Bye
Brian Mearns wrote:
> On Mon, Mar 30, 2009 at 4:15 PM, Alessandro Fantuzzi <fa...@o-one.net> wrote:
>
>> We have a site running on Apache and Tomcat
>> LINUX
>> APACHE 2.0.59
>> TOMCAT 5.5.20
>> JVM 1.5
>>
>> We have to put some pages under SSL, just some, say:
>>
>> https://www.site.com/public/subscribe.jsp
>> https://www.site.com/public/unsubscribe.jsp
>>
>> We will install the 128 bit certificate under Apache Http server.
>> Path /public contains other pages but we want to put under SSL just the ones
>> mentioned before. Is this possible ?
>>
>> Should we create two Vitrual hosts, one for port 80 and one for 443 ?
>>
>> How do we force the user using the correct port, should we create rewrite
>> rules from one Virtual Host to the other ?
>>
>> Thanks in advance
>>
> [clip]
>
> If you want to serve both SSL and non-SSL, then yes, you need two
> different hosts listening on the two ports as you mentioned. This
> alone is not enough, of course, just telling apache to listen on 443
> does not set up an SSL server, but it is necessary for what you want.
>
> Are you actually adverse to serving other content on SSL? In other
> words, if most pages are available on both SSL and non-SSL, is that
> okay? If that's the case, you can just serve the same content from
> both virtual hosts, but add some RequireSSL directives in a
> <FileMatch>, <Location>, or similar tag for the "secure" pages so that
> they are only accessible via HTTPS. Creating HTML links to https://...
> will suffice for getting the user there.
>
> On a related note, it seems to me that 128 bits is not a remotely
> secure key. I can't say for sure, but as I recall, anything under 1024
> bits is considered trivial, 2048 or 4096 is better.
>
> Hope that helps.
> -Brian
>
>
--
Alessandro Fantuzzi - O-one s.r.l.
E-mail: fantuzzi@o-one.net <ma...@o-one.net>
Software developer
www.o-one.net <http://www.o-one.net>
-------------------------------------------------------------------
Via Dante Zanichelli, 61 - 42100 Reggio Emilia
Tel. 0522 930078 - Fax. 0522 387947
-------------------------------------------------------------------
Via Stendhal, 36 - 20144 Milano
Tel 02.42292057 - Fax 02.47770936
-------------------------------------------------------------------
STRICTLY PERSONAL AND CONFIDENTIAL This message may contain confidential
and proprietary material for the sole use of the intended recipient. Any
review or distribution by others is strictly prohibited. If you are not
the intended recipient please contact the sender and delete all copies.
The contents of this message that do not relate to the official business
of our company shall be understood as neither given nor endorsed by it.
-------------------------------------------------------------------
Re: [users@httpd] From https to http and vice versa
Posted by Brian Mearns <me...@gmail.com>.
On Mon, Mar 30, 2009 at 4:15 PM, Alessandro Fantuzzi <fa...@o-one.net> wrote:
> We have a site running on Apache and Tomcat
> LINUX
> APACHE 2.0.59
> TOMCAT 5.5.20
> JVM 1.5
>
> We have to put some pages under SSL, just some, say:
>
> https://www.site.com/public/subscribe.jsp
> https://www.site.com/public/unsubscribe.jsp
>
> We will install the 128 bit certificate under Apache Http server.
> Path /public contains other pages but we want to put under SSL just the ones
> mentioned before. Is this possible ?
>
> Should we create two Vitrual hosts, one for port 80 and one for 443 ?
>
> How do we force the user using the correct port, should we create rewrite
> rules from one Virtual Host to the other ?
>
> Thanks in advance
[clip]
If you want to serve both SSL and non-SSL, then yes, you need two
different hosts listening on the two ports as you mentioned. This
alone is not enough, of course, just telling apache to listen on 443
does not set up an SSL server, but it is necessary for what you want.
Are you actually adverse to serving other content on SSL? In other
words, if most pages are available on both SSL and non-SSL, is that
okay? If that's the case, you can just serve the same content from
both virtual hosts, but add some RequireSSL directives in a
<FileMatch>, <Location>, or similar tag for the "secure" pages so that
they are only accessible via HTTPS. Creating HTML links to https://...
will suffice for getting the user there.
On a related note, it seems to me that 128 bits is not a remotely
secure key. I can't say for sure, but as I recall, anything under 1024
bits is considered trivial, 2048 or 4096 is better.
Hope that helps.
-Brian
--
Feel free to contact me using PGP Encryption:
Key Id: 0x3AA70848
Available from: http://pgp.mit.edu/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] From https to http and vice versa
Posted by Krist van Besien <kr...@gmail.com>.
On Mon, Mar 30, 2009 at 10:15 PM, Alessandro Fantuzzi
<fa...@o-one.net> wrote:
> We have to put some pages under SSL, just some, say:
>
> https://www.site.com/public/subscribe.jsp
> https://www.site.com/public/unsubscribe.jsp
Generally speaking the moment you put some pages under SSL you can as
well put all pages under SSL. Is a lot easier to manage and with
today's hardware your users will hardly notice it.
Krist
--
krist.vanbesien@gmail.com
krist@vanbesien.org
Bremgarten b. Bern, Switzerland
--
A: It reverses the normal flow of conversation.
Q: What's wrong with top-posting?
A: Top-posting.
Q: What's the biggest scourge on plain text email discussions?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org