Home / server / Questions / 165347
Accepted
Daniel
Asked: 2010-07-30 08:55:30 +0800 CST

Forcing HTTPS from HTTP (Apache)

  • 772

What is the best way to always reroute all traffic from http to https on Apache 2?

All requests to 80 should go to 443.

(I am using Ubuntu + Apache 2)

apache-2.2

3 Answers

  1. Best Answer

    Expanding on freiheit's answer, removing some redundant parts, eliminating the dependence on mod_rewrite (and associated speed penalty), and adding in some security:

    <VirtualHost 1.2.3.4:80>
        ServerName SSL.EXAMPLE.COM
        CustomLog /var/log/httpd/EXAMPLE.access_log combined
        ErrorLog /var/log/httpd/EXAMPLE.error_log

        Redirect / https://ssl.example.com/
</VirtualHost>

<VirtualHost 1.2.3.4:443>
    ServerName ssl.example.com
    DocumentRoot /var/www/html
    CustomLog /var/log/httpd/EXAMPLE.ssl_access_log combined
    ErrorLog /var/log/httpd/EXAMPLE.ssl_error_log
    SSLEngine on
    SSLProtocol all -SSLv2
    SSLCipherSuite HIGH:MEDIUM
    .
    .
    .
</VirtualHost>

<Directory /var/www/html>
    #If all else fails, this will ensure nothing can get in without being encrypted.
    SSLRequireSSL
</Directory>
    • 3

  2. Personally, my favorite is to simply redirect all port 80 traffic to port 443:

    <VirtualHost 1.2.3.4:80>
        ServerName SSL.EXAMPLE.COM
        ServerAlias SSL
        DocumentRoot /var/www/html
        CustomLog /var/log/httpd/EXAMPLE.access_log combined
        ErrorLog /var/log/httpd/EXAMPLE.error_log

        RewriteEngine on
        RewriteRule .* https://SSL.EXAMPLE.COM/ [NC,R,L]
</VirtualHost>

<VirtualHost 1.2.3.4:443>
    ServerName ssl.example.com
    DocumentRoot /var/www/html
    CustomLog /var/log/httpd/EXAMPLE.ssl_access_log combined
    ErrorLog /var/log/httpd/EXAMPLE.ssl_error_log
    SSLEngine on
    SSLProtocol all -SSLv2
    SSLCipherSuite HIGH:MEDIUM
    .
    .
    .
</VirtualHost>
    • 1

  3. RewriteCond %{SERVER_PORT} ^80$
    RewriteRule ^/(.*) https://your.server.name/$1 [R]

    • 1