You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Rodman <ro...@thefrowerts.com> on 2007/03/29 17:51:33 UTC
[users@httpd] mod_ssl question
Hello,
Have a question pertaining to using mod_ssl on one of my virtual sites. I am running a web mail application in a directory on one of my sites and I was wondering if it would be possible to secure just a particular directory and everything under it. For example, my site is www.example.com but I am wanting to secure www.example.com\mail. Can it be possible to just use SSL on that particular directory rather than securing an entire site. The reason I am asking is that I am going to use a self signed certificate (not going to pay an outrageous price of $800+) and I.E. complains about a certificate not being signed by a root authority. I only need a handful of users going to the "\mail" directory and I can have them import the certificate so that I.E. doesn't complain each time one of them tries to access that directory. The public accessing www.example.com doesn't need SSL and if I had to turn it on for the whole site, I.E. might scare them away when it says the certificate can't be verified...
Thanks guys!
Rodman
Re: [users@httpd] mod_ssl question
Posted by Sander Temme <sc...@apache.org>.
On Mar 29, 2007, at 1:25 PM, Rodman wrote:
> Ahhhh, that makes so much more sense. I didn't even think to have
> two virtual hosts of the same site but have one of them SSL while
> the other is standard port 80. Redirecting should be easy then.
Yes, if you put your Redirect in the main server config, your SSL
virtual host will inherit it and create a redirect loop.
S.
--
sctemme@apache.org http://www.temme.net/sander/
Open Source Software Consultant
PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
ApacheCon 2007 Europe, May 1-4 in Amsterdam
http://www.eu.apachecon.com/
Re: [users@httpd] mod_ssl question
Posted by Rodman <ro...@thefrowerts.com>.
Ahhhh, that makes so much more sense. I didn't even think to have two
virtual hosts of the same site but have one of them SSL while the other is
standard port 80. Redirecting should be easy then.
Thanks Joshua! I appreciate the help! I'll setup it up tonight.
Rodman
----- Original Message -----
From: "Joshua Slive" <jo...@slive.ca>
To: <us...@httpd.apache.org>
Sent: Thursday, March 29, 2007 2:46 PM
Subject: Re: [users@httpd] mod_ssl question
> On 3/29/07, Rodman <ro...@thefrowerts.com> wrote:
>> Great!! Now I have to figure out how to do it. You wouldn't happen to
>> have
>> a link handy with some basic instructions on how to secure just a
>> directory
>> instead of an entire site? I'm guessing that I would have to use some
>> sort
>> of SSL <Directory></Directory> container inside my <Virtual> container
>> but
>> this is just a guess.
>>
>> I'll check with godaddy and see what I can dig up for cheaper
>> certificates...
>
> You're thinking about this from the wrong perspective.
>
> Once you have SSL, you will have two separate websites: one with ssl
> using https on port 443, and one without ssl using http on port 80.
> Each should have it's own <VirtualHost> block in your config.
>
> Then if you want certain content to be available in only one vhost or
> the other, you put directives in these <VirtualHost>s to make it
> happen. For example, if you want the mail directory to be available
> only on the ssl host, then redirect requests for /mail under the
> non-ssl host over to the ssl host:
>
> <VirtualHost *:80>
> ...
> Redirect /mail https://mysite.example.com/mail
> ...
> </VirtualHost>
>
> You can also use the SSLRequireSSL directive in a <Directory> section,
> but it isn't strictly necessary.
>
> Joshua.
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_ssl question
Posted by Joshua Slive <jo...@slive.ca>.
On 3/29/07, Rodman <ro...@thefrowerts.com> wrote:
> Great!! Now I have to figure out how to do it. You wouldn't happen to have
> a link handy with some basic instructions on how to secure just a directory
> instead of an entire site? I'm guessing that I would have to use some sort
> of SSL <Directory></Directory> container inside my <Virtual> container but
> this is just a guess.
>
> I'll check with godaddy and see what I can dig up for cheaper
> certificates...
You're thinking about this from the wrong perspective.
Once you have SSL, you will have two separate websites: one with ssl
using https on port 443, and one without ssl using http on port 80.
Each should have it's own <VirtualHost> block in your config.
Then if you want certain content to be available in only one vhost or
the other, you put directives in these <VirtualHost>s to make it
happen. For example, if you want the mail directory to be available
only on the ssl host, then redirect requests for /mail under the
non-ssl host over to the ssl host:
<VirtualHost *:80>
...
Redirect /mail https://mysite.example.com/mail
...
</VirtualHost>
You can also use the SSLRequireSSL directive in a <Directory> section,
but it isn't strictly necessary.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_ssl question
Posted by Rodman <ro...@thefrowerts.com>.
Great!! Now I have to figure out how to do it. You wouldn't happen to have
a link handy with some basic instructions on how to secure just a directory
instead of an entire site? I'm guessing that I would have to use some sort
of SSL <Directory></Directory> container inside my <Virtual> container but
this is just a guess.
I'll check with godaddy and see what I can dig up for cheaper
certificates...
Rodman
----- Original Message -----
From: "Dragon" <dr...@crimson-dragon.com>
To: <us...@httpd.apache.org>
Sent: Thursday, March 29, 2007 11:17 AM
Subject: Re: [users@httpd] mod_ssl question
> Rodman wrote:
>>Hello,
>>
>>Have a question pertaining to using mod_ssl on one of my virtual sites. I
>>am running a web mail application in a directory on one of my sites and I
>>was wondering if it would be possible to secure just a particular
>>directory and everything under it. For example, my site is
>><http://www.example.com>www.example.com but I am wanting to secure
>><http://www.example.com\mail>www.example.com\mail. Can it be possible to
>>just use SSL on that particular directory rather than securing an entire
>>site. The reason I am asking is that I am going to use a self signed
>>certificate (not going to pay an outrageous price of $800+) and I.E.
>>complains about a certificate not being signed by a root authority. I
>>only need a handful of users going to the "\mail" directory and I can have
>>them import the certificate so that I.E. doesn't complain each time one of
>>them tries to access that directory. The public accessing
>><http://www.example.com>www.example.com doesn't need SSL and if I had to
>>turn it on for the whole site, I.E. might scare them away when it says the
>>certificate can't be verified...
>>
>>Thanks guys!
>>
>>Rodman
> ---------------- End original message. ---------------------
>
> Yes, you can secure any portion of a site, there is no need to do the
> whole thing.
>
> Also, there are affordable certificates available. I paid $35 for one from
> GoDaddy for a web ticketing system I did for a non-profit event. VeriSign
> and their ridiculously inflated pricing is not the only option.
>
> Dragon
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Venimus, Saltavimus, Bibimus (et naribus canium capti sumus)
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] unsunscribe
Posted by "Clarke, James" <ja...@pearson.com>.
-----Original Message-----
From: Dragon [mailto:dragon@crimson-dragon.com]
Sent: 29 March 2007 17:17
To: users@httpd.apache.org
Subject: Re: [users@httpd] mod_ssl question
Rodman wrote:
>Hello,
>
>Have a question pertaining to using mod_ssl on one of my virtual sites.
>I am running a web mail application in a directory on one of my sites
>and I was wondering if it would be possible to secure just a particular
>directory and everything under it. For example, my site is
><http://www.example.com>www.example.com but I am wanting to secure
><http://www.example.com\mail>www.example.com\mail. Can it be possible
>to just use SSL on that particular directory rather than securing an
>entire site. The reason I am asking is that I am going to use a self
>signed certificate (not going to pay an outrageous price of $800+) and
>I.E. complains about a certificate not being signed by a root
>authority. I only need a handful of users going to the "\mail"
>directory and I can have them import the certificate so that I.E.
>doesn't complain each time one of them tries to access that directory.
>The public accessing <http://www.example.com>www.example.com doesn't
>need SSL and if I had to turn it on for the whole site, I.E. might
>scare them away when it says the certificate can't be verified...
>
>Thanks guys!
>
>Rodman
---------------- End original message. ---------------------
Yes, you can secure any portion of a site, there is no need to do the
whole thing.
Also, there are affordable certificates available. I paid $35 for one
from GoDaddy for a web ticketing system I did for a non-profit event.
VeriSign and their ridiculously inflated pricing is not the only option.
Dragon
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Venimus, Saltavimus, Bibimus (et naribus canium capti sumus)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server
Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
This email may contain confidential material. If you were not an
intended recipient, please notify the sender and delete all copies.
We may monitor email to and from our network.
This email was sent by a company within the corporate group owned
by Pearson plc, registered office at 80 Strand, London WC2R 0RL,
registered in England and Wales with company number 53723 and
VAT number GB 278 5371 21.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_ssl question
Posted by Dragon <dr...@crimson-dragon.com>.
Rodman wrote:
>Hello,
>
>Have a question pertaining to using mod_ssl on one of my virtual
>sites. I am running a web mail application in a directory on one of
>my sites and I was wondering if it would be possible to secure just
>a particular directory and everything under it. For example, my
>site is <http://www.example.com>www.example.com but I am wanting to
>secure <http://www.example.com\mail>www.example.com\mail. Can it be
>possible to just use SSL on that particular directory rather than
>securing an entire site. The reason I am asking is that I am going
>to use a self signed certificate (not going to pay an outrageous
>price of $800+) and I.E. complains about a certificate not being
>signed by a root authority. I only need a handful of users going to
>the "\mail" directory and I can have them import the certificate so
>that I.E. doesn't complain each time one of them tries to access
>that directory. The public accessing
><http://www.example.com>www.example.com doesn't need SSL and if I
>had to turn it on for the whole site, I.E. might scare them away
>when it says the certificate can't be verified...
>
>Thanks guys!
>
>Rodman
---------------- End original message. ---------------------
Yes, you can secure any portion of a site, there is no need to do the
whole thing.
Also, there are affordable certificates available. I paid $35 for one
from GoDaddy for a web ticketing system I did for a non-profit event.
VeriSign and their ridiculously inflated pricing is not the only option.
Dragon
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Venimus, Saltavimus, Bibimus (et naribus canium capti sumus)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org