Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
From: Stefan Eissing <stefan.eissing@greenbytes.de>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Subject: Re: Listen 443 https
Date: Mon, 4 Sep 2017 10:42:48 +0200
References: <678BA83E-09F8-4216-9F8A-675176BEDCCB@greenbytes.de>
 <CACsi253MnMrmh5vxLnxbT7uhn_nWtEhhJnRVC7riXwCyGSQ3PA@mail.gmail.com>
 <A3713651-58B7-4C4F-8236-3EDE7D8E59CD@greenbytes.de>
 <D83829DE-9240-4352-AB8A-76DC368B7091@greenbytes.de>
 <CALK=YjO7ypQqL=6nXW3=ZBmOs=1aQTZVcdkXjqvWvgs00vRJeA@mail.gmail.com>
To: dev@httpd.apache.org
In-Reply-To: <CALK=YjO7ypQqL=6nXW3=ZBmOs=1aQTZVcdkXjqvWvgs00vRJeA@mail.gmail.com>
Message-Id: <A1FA191D-F104-45D1-97D0-0F52EF408FF5@greenbytes.de>
archived-at: Mon, 04 Sep 2017 08:43:00 -0000


> Am 01.09.2017 um 17:12 schrieb Eric Covener <covener@gmail.com>:
>=20
> On Fri, Sep 1, 2017 at 10:39 AM, Stefan Eissing
> <stefan.eissing@greenbytes.de> wrote:
>> I get the first feedback from Apache users that want their http: only =
hosts to also serve https:. This is nice feedback to improve usability =
of mod_md.
>>=20
>> Ideally, what these people want - and that is purely my =
interpretation - is to add a few lines to their config and  - voila - =
https: is available. And, honestly, why should they not expect that?
>>=20
>>=20
>>=20
>> Example: Duplication/Redirect
>>=20
>> They have something like:
>> ----------------------------------
>> Listen 80
>> <VirtualHost *:80>
>>  ServerName xxx.yyy
>>  ...
>> </VirtualHost>
>> ----------------------------------
>>=20
>> and want to also make that available on https:
>> ----------------------------------
>> Listen http://*:80
>> Listen https://*:443
>>=20
>> <VirtualHost *:80>
>>  ServerName xxx.yyy
>>  AlternatePorts 443
>>  ...
>> </VirtualHost>
>> ----------------------------------
>>=20
>> or redirect everyone to https:
>> ----------------------------------
>> Listen http://*:80
>> Listen https://*:443
>>=20
>> <VirtualHost *:443>
>>  ServerName xxx.yyy
>>  RedirectPermanent=46rom 80
>>  ...
>> </VirtualHost>
>=20
> I am not keen on the syntax because we already permit multiple
> addresses in the VirtualHost tag.
>=20
> How about e.g.
>=20
> <virtualhost *:80 *:443>
>  # no protocol
>  ServerName example.com
>  # repurpose "optional" or pick something new
>  SSLEgine optional
>  # Extend SSLRequireSSL.  no-arg is deny. Default w/ "redirect" is
> 80, 443. For redirects, may need to not match TCP listening port
>  SSLRequireSSL ["redirect" [ from-port to-port ]]
> </virtualhost>

I like the SSLRequireSSL gist. I was thinking about this over the =
weekend and like the following a lot:

  SSLEngine *:443 10.0.0.1:8001
  SSLRequireSSL ["temporary"|"permanent" [ from-port to-port ]]

with "permanent" as default and port 443, or the first port in SSLEngine =
- if given - as default.

This can be specified in a <VirtualHost> or, better even, in the base =
server. I think this can, together with multiple ports at <VirtualHost>, =
simplify configurations of TLS hosts. At least for people who want to =
offer the same resources on 80 and 443, or want to migrate existing *:80 =
hosts to TLS.

What do you think?

-Stefan