httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Boyle Owen" <Owen.Bo...@swx.com>
Subject RE: [users@httpd] Virtual Hosting and SSL
Date Tue, 20 Dec 2005 10:40:31 GMT
> -----Original Message-----
> From: Jerry Baker [mailto:jerry@bakerweb.biz]
> 
> I guess another way of putting it is, I am looking to see if it is 
> possible to just tell Apache that anything on port 443 is to 
> be treated 
> as SSL and anything on port 80 is to be treated as normal 
> HTTP? It seems 
> awkward and clumsy to have to have two virtual hosts for every real 
> virtual host just to include SSL.

First, the lecture:

"...just to include SSL." is your wrongthink.

SSL (or to be more accurate, HTTPS) is an additional layer on top of HTTP so it is like it
is a different protocol. Therefore your question is a bit like, "Do I have to install Sendmail,
just to include SMTP?"

For HTTPS to work, it needs a unique TCP/IP socket on which to begin the HTTPS negotiation.
That is conventionally port 443. Happily, apache (using mod_ssl) can be configured to handle
an HTTPS session, but it requires a virtual host to be configured to handle the requests once
they are decrypted. This VH then includes all the SSL directives (eg, SSLEngine on) so it
can't be used for plain HTTP.

I think the underlying problem is that you want a site that automatically works in HTTP or
HTTPS with identical content under each. I'm sure you have your reasons, but have you thought
through exactly why you want this? SSL is used to protect data when it's on the public part
of the route between the client and server. This would either be private data submitted by
the client (eg, credit card number) or sent by the server (eg, personal user data held on
a server). Why would you want these resources also available under plain HTTP? If people used
the HTTP URLs, the data would not be protected. It's a bit like phoning your bank up and asking
them to send you some money and, depending on the number you call, they either send it round
in an armoured car or post it in the mail in a see-through envelope.

Second, a possible solution:

Having said all that, you might be able to construct a suitably complicated boolean expression
which you can use in SSLRequire to switch on and off SSL on a per-request basis (see http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslrequire).
Alternatively, you can keep the two VHs but put the common directives in an included file
(see http://httpd.apache.org/docs/2.0/mod/core.html#include).

Rgds,
Owen Boyle
Disclaimer: Any disclaimer attached to this message may be ignored. 





> 
> -- 
> Jerry Baker
> 
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP 
> Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>    "   from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
> 
> 
Diese E-mail ist eine private und persönliche Kommunikation. Sie hat keinen Bezug zur Börsen-
bzw. Geschäftstätigkeit der SWX Gruppe. This e-mail is of a private and personal nature.
It is not related to the exchange or business activities of the SWX Group. Le présent e-mail
est un message privé et personnel, sans rapport avec l'activité boursière du Groupe SWX.
 
 
This message is for the named person's use only. It may contain confidential, proprietary
or legally privileged information. No confidentiality or privilege is waived or lost by any
mistransmission. If you receive this message in error, please notify the sender urgently and
then immediately delete the message and any copies of it from your system. Please also immediately
destroy any hardcopies of the message. You must not, directly or indirectly, use, disclose,
distribute, print, or copy any part of this message if you are not the intended recipient.
The sender's company reserves the right to monitor all e-mail communications through their
networks. Any views expressed in this message are those of the individual sender, except where
the message states otherwise and the sender is authorised to state them to be the views of
the sender's company.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message