Re: [mod-security-users] How to redirect to a https domain name

[Reindl H. <h.r...@th...>]

Am 12.04.19 um 01:12 schrieb Monah Baki:
> I have a webserver running on port 80 and 443, and another server
> running modsecurity, my A record for www is the IP address of the WAF
> running apache/modsecurity
> 
> on my waf httpd.conf:
> 
> <VirtualHost *:80>
> ServerName www.<domainname>.com
> #DocumentRoot /var/www/htdocs
> ProxyPreserveHost On
> ProxyPass / http://<ipaddress of webserver>/
> ProxyPassReverse / http://<ipaddress of webserver>/
> 
> From the web if I enter http://URL, it works, and it also works if I
> enter the http://IP_address.
> 
> However if I change the following in my WAF httpd.conf  to:
> ProxyPass / https://www.<domainname>.com/
> ProxyPassReverse / https:// www.<domainname>.com /
> 
> It stops working, basically I am trying to redirect http to https

besides it's not a modsec topic why would you want to do that?

if you use a proxy anyways install the certificates on the proxy and
keep your backend connections unencrypted (it's called tls offloading)

a ton of reasons:

* seperate enryption load from backend servers
* minimize overhead between proxy and backend

 <IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteCond %{HTTPS} off
  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
 </IfModule>