top button
Flag Notify
    Connect to us
      Site Registration

Site Registration

ssl on tomcat: making all links also https

+1 vote
425 views

I'm using apache 2.2 as front end and apache tomcat 6.0.37 as backend. I'm using mod_jk for connecting them.

The problem is. I'm using ssl certificates and configured ssl on apache. when I connect the site with https it works but when I click on an link it no more secure i.e. its not secure browsing anymore.

My requirement is as follows.

If user connects as https all the links should work as https. If the user connects as http all the links should work as http is such thing is possible?

posted Dec 4, 2013 by Meenal Mishra

Share this question
Facebook Share Button Twitter Share Button LinkedIn Share Button
Do you mean that links on your https:// pages are http:// (i.e. non-secure) links? What does the code look like that produced your pages (e.g. static file, JSP, or servlet)?

Give us the following and we can help:

a.  configuration for all connectors. Remember to remove any sensitive information you may have in that configuration.
b.. Explain how your webapp produces link URLs. An example would be great.
Yes. I have so many http links as some of our old submitted apps used non secured http links as the apps are in use we cannot change it. I cannot use any redirect rules to convert all the http to https because of that.

We use struts for framework. And normal jsp pages. I'm not a developer so cant say much about it.

This is in my server.xml
$ cat mod_jk.conf
# Where to find workers.properties
JkWorkersFile /etc/httpd/conf.d/workers.properties
# Where to put jk logs
JkLogFile /var/log/httpd/mod_jk.log
# Set the jk log level [debug/error/info]
JkLogLevel info
# Select the log format
JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "
# JkOptions indicate to send SSL KEY SIZE,
JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories
# JkRequestLogFormat set the request format
JkRequestLogFormat "%w %V %T"
# Send servlet for context /examples to worker named worker1
#JkMount /examples worker1
# Send JSPs for context /examples/* to worker named worker1
JkMount /* worker1
JkShmFile /etc/httpd/logs/jk-runtime-status

$ cat /etc/httpd/conf.d/workers.properties
#workers.tomcat_home=/usr/tomcat/apache-tomcat-6.0.26
#workers.tomcat_home=/usr/share/tomcat5
workers.tomcat_home=/usr/share/apache-tomcat-6.0.37/
workers.java_home=/usr/java/default
ps=/
worker.list=worker1
worker.default.port=8009
worker.default.host=localhost
worker.default.type=ajp13
#worker.default.lbfactor=1

Let me know if there is anything else i need to provide

1 Answer

+1 vote

The basic problem is that these old apps are very badly written, if they use absolute URLs to point to things on the same site.

The only real good way to do this, is to modify these apps and pages, to use relative links. Maybe you could do that with some automated script ?

#http://myserver.com/(.*)$#/$1#g

Otherwise, you are going to be applying patches over patches over redirects over rewrites all over the place, and there will always be something not working, and it will be a maintenance nightmare.

What you have to think about it this :
- If *the browser* gets a html page containing a link that starts with "http://", then *the browser* is going to establish a HTTP (non-secure) connection with the server, and send that request through this connection.
- If *the browser* gets a html page containing a link that starts with "https://", then *the browser* is going to establish a HTTPS (secure) connection with the server, and pass that request through this connection.

There is nothing that the server can do, to magically change a HTTP to a HTTPS connection. (At best, the server could send back a "redirect" response).

So if your pages, server-side, originally contain links that start with "http://", you have to change those links, *inside of the pages*, before you send them to the browser. Otherwise there is little that you can do on the server side.

You can theoretically achieve this, on the server side, with a filter which examines all the outgoing pages and replaces the links in them before they go out to the browser, but as you can imagine this is very inefficient, and prone to errors.

answer Dec 5, 2013 by Kumar Mitrasen
Similar Questions
0 votes

I'm trying to setup a forward proxy to access certain endpoints on Remote server which require https with basic authentication in header.

A(Application server) ---> Forward proxy (B) ----> Remote server(C)

i'm at B on which i have setup below Apache Virtual host in which i'm setting the headers to use basic authentication passing encoded value of user & pass configured on remote server.However,i want to include HTTPS in my request to C to ensure the headers are sent securely with encrption to remote server (C). I do Not want to use a separate Virtual host for HTTPS. Should i include a SSL Server certificate in my proxy configuration as given below with the basic authentication in header ?
How can i achieve this in Single virtual host ? I have limited knowledge on apache, so please help here.

I tried searching on the internet but did not find the required solution.

##### vHost 9099 is for basic auth with HTTPS #####
Listen *:9099
<VirtualHost *:9099>

        ServerName      myservername.com
        ServerAlias     myservername.com
        ServerAdmin     iamadmin@myservername.com
        DocumentRoot    /my/doc/root/
        SSLEngine on
        RewriteEngine On
        AllowEncodedSlashes NoDecode

        ProxyRequests On

        # SSL configuration

        SSLCertificateFile       /Path to cert.pem
        SSLCertificateKeyFile    /Path to private key
        SSLCACertificateFile     /Path to CA certs


        ##  Basic64  Encoded XXXX od user and passwd in header

         RequestHeader set Authorization "Basic XXXXX"


         ##  Endpoints accessed via https with basic authentication in header

         ProxyPass /api/api1/   https://30.30.115.22:11111/api/api1/
         ProxyPassReverse /api/api1/    https://30.30.115.22:11111/api/api1/


</VirtualHost>
+1 vote

How do I checks what ciphers are available to the https compiled binary, and how do I check with of those are active in the configuration?

Is there any technical reason that ECDHE-RSA-AES128-SHA256 cannot be used on a server with a self-signed cert (there's no e-commerce or any financial data of any sort on the server).

If an existing server wants to switch so that all traffic is encrypted using DH if possible (interested in implementing Perfect Forward Secrecy) are there any "Gotcha's" lurking in the bushes?

If you enable ECDHE-RSA-AES128-SHA256, should you disable EDH?

To be accessible for most people (including some Windows XP users), what else do I need to enable in the cipher suite? RC4? RC4-SHA? TLSv1? AES?

Which ones do I need to avoid?

0 votes

How to use multiple virtual hosts with a single SSL instance running on the standard https port.

0 votes

How do I get a valid certificate for a box that is behind a firewall and does not have a DNS entry?

I was looking at letsencrypt.org but currently it looks like a valid DNS entry is needed, of which I don't have.

There is nothing special about my setup, its just a box that is not directly on the internet, no DNS entry but I need HTTPS to run correctly.

How do I generate a trusted certificate base on IP or something?

How can I do that? Thanks,

0 votes

how to manage the secured connection error in HTTPS?

...