How do I force Apache to use HTTPS in conjunction with AJP?
Solution 1:
If I understand you correctly, you want to upgrade all http requests to https. If this is correct try this
<VirtualHost ip:80>
ServerName www.company.com
RedirectMatch permanent ^(.*)$ https://www.company.com$1
</VirtualHost>
<VirtualHost ip:443>
ServerName www.company.com
Include vhosts.d/includes/ssl.conf
# assumes you want to proxy everything on this vhost to jboss:8009
<Location / >
ProxyPass ajp://jboss:8009/
</Location>
</VirtualHost>
Solution 2:
This syntax will redirect to HTTPS keeping the host and URL same:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
Sometimes you only want to redirect a directory, i.e. an adminstration area:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^/admin(|/.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
Solution 3:
However you solve it, can I suggest putting the directive SSLRequireSSL in the locations you want to be SSL only. That way if there's a config error later in the process, nothing is exposed over a non-SSL connection.
Solution 4:
The more efficient syntax for ssl redirection is using the apache env var HTTPS
You do like this:
Host rewriting
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://yourhost.com%{REQUEST_URI} [R,L]
Without host rewriting
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
In regards to mod_jk vs apache2.2 ajp proxy I use mod_jk just because I find JkMount and JkUnMount to be useful when you need to separate static and dynamic content, I'd say is more straightforward. The way I structure my configurations is with conditional including for ssl. So I have one httpd.conf for each host, I have a dir for each conf include the following way:
/etc/httpd/test_conf.httdp.conf:
SeverName test.com
ServerRoot /etc/httpd
LoadModule jk_module modules/mod_jk.so
LoadModule ssl_module/mod_ssl.so
(snip)
Include conf/test_com/*.conf
/etc/httpd/test_conf/mod_jk.conf
<IfModule jk_module>
JkWorkersFile conf/test_conf/workers.properties
JkLogFile logs/test_conf/mod_jk.log
JkLogLevel error
JkLogStampFormat "[%a %b %d %H:%M:%S %Y]"
JkRequestLogFormat "%w %V %T"
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(PUT|DELETE|TRACK|OPTIONS|TRACE)
RewriteRule .* - [F]
JkMount /* loadbalancer
JkUnMount /error* loadbalancer
JkShmFile run/jk.shm
<Location /jkstatus/>
JkMount status
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Location>
</IfModule>
/etc/httpd/conf/test_conf/workers.properties
worker.list=loadbalancer,status
worker.node1.port=8009
worker.node1.host=192.168.1.100
worker.node1.type=ajp13
worker.node1.lbfactor=2
worker.node1.ping_mode=A
worker.node1.connect_timeout=10000
worker.node1.prepost_timeout=10000
worker.node1.socket_timeout=90
worker.node1.connection_pool_timeout=600
worker.node1.method=R
worker.node1.fail_on_status=500,501,502,503
worker.node2.reference=worker.node1
worker.node2.host=192.168.1.200
worker.loadbalancer.type=lb
worker.loadbalancer.balance_workers=node1,node2
worker.loadbalancer.sticky_session=true
worker.status.type=status
/etc/httpd/conf/test_conf/httpd-ssl.conf
<IfModule ssl_module>
Listen 192.200.10.100:443
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
(snip)
<VirtualHost 192.200.10.100:443>
DocumentRoot "/var/www/test.com/htdocs"
ServerName test.com
(snip)
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA
SSLCertificateFile "conf/test_conf/ssl/test_com.crt"
SSLCertificateKeyFile "conf/test_conf/ssl/test_com.key"
SSLCACertificateFile "conf/test_conf/ssl/VerisignIntermediate.crt"
BrowserMatch ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
JkMount /* loadbalancer
JkUnMount /error* loadbalancer
JkStripSession On
</VirtualHost>
</IfModule>