Re: [mod-security-users] How to redirect to a https domain name

[Manuel S. <spa...@gm...>]

+1

Sent from my iPhone

> On 11 Apr 2019, at 18:25, Reindl Harald <h.r...@th...> wrote:
> 
> 
> 
>> Am 12.04.19 um 01:12 schrieb Monah Baki:
>> I have a webserver running on port 80 and 443, and another server
>> running modsecurity, my A record for www is the IP address of the WAF
>> running apache/modsecurity
>> 
>> on my waf httpd.conf:
>> 
>> <VirtualHost *:80>
>> ServerName www.<domainname>.com
>> #DocumentRoot /var/www/htdocs
>> ProxyPreserveHost On
>> ProxyPass / http://<ipaddress of webserver>/
>> ProxyPassReverse / http://<ipaddress of webserver>/
>> 
>> From the web if I enter http://URL, it works, and it also works if I
>> enter the http://IP_address.
>> 
>> However if I change the following in my WAF httpd.conf  to:
>> ProxyPass / https://www.<domainname>.com/
>> ProxyPassReverse / https:// www.<domainname>.com /
>> 
>> It stops working, basically I am trying to redirect http to https
> 
> besides it's not a modsec topic why would you want to do that?
> 
> if you use a proxy anyways install the certificates on the proxy and
> keep your backend connections unencrypted (it's called tls offloading)
> 
> a ton of reasons:
> 
> * seperate enryption load from backend servers
> * minimize overhead between proxy and backend
> 
> <IfModule mod_rewrite.c>
>  RewriteEngine on
>  RewriteCond %{HTTPS} off
>  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
> </IfModule>
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/