Question

I am getting a SSL connection for my website, meaning I can access it with HTTPS. This is the first time I did such a thing and I’d like to know the basic stuff I need to do on my script to make it work as it should with the new connection.

My website uses cookies and sessions. I also need to know how I should force the user to use HTTPS instead of HTTP (ie: redirect to HTTPS if the user used HTTP).

Thank you.

Answer 1

If you need to force SSL for A particular URL’s then you can do something like this

Rewrite incoming URL’s on port 80 with a particular pattern;

RewriteCond %{REQUEST_URI} ^/PATH-YOU-WANT-TO-RESTRICT$
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://%{SERVER_NAME}$1 [R,L]

You will also need to ensure that your apache server is listening for requests coming in on port 443. This can be done easily in your httpd.conf file;

Listen servername:443

You will also require a Virtual host on our Apache server;

LoadModule ibm_ssl_module modules/mod_ibm_ssl.so

<VirtualHost servername:443>
    SSLEnable
    ServerName servername
    SSLClientAuth None
    ErrorLog /servername/conf/ssl/logs/https-error_log
    RewriteEngine On
    Include conf/vanity_rules/vanity_rewrite_rules.conf
    KeyFile /servername/conf/ssl/yourkey.kdb
</VirtualHost>

This configuration will ensure that the transport between browser and your Apache server is all encrypted.