Question

I have a load balanced dev site that I’m working out bugs for SSL on and I have ran into one last very annoying issue. On some pages I need to force it to SSL so easy enough, I just wanted to create a

header ("Location: https://www.example.com/mypage.php");

I thought that was easy enough and no worries. However, every time I do this it transforms it back to http. Well as you can figure it creates an endless loop that can’t be resolved. I can’t figure out how to keep that https in there so that it will pull the secure version of the page. If I navigate directly to the secure page with https it works just fine. The only issue is on this redirect.

Any help would be awesome! I’m using POUND as a load balance proxy. Apache on the web-server nodes. The SSL cert is setup at the Load Balancer.

Answer 1

When loadbalancing, ‘internal’ SSL usually goes out the door: Clients connect through a load-balancer with which you can do SSL encryption, but behind that in most loadbalancers I’ve seen is plain ‘HTTP’. Try to get your loadbalancer to set a custom header to you indicating that there is a HTTPS connection between loadbalancer & client.

From http://www.apsis.ch/pound/index_html

WHAT POUND IS:
…
an SSL wrapper: Pound will decrypt HTTPS requests from client browsers and pass them as plain HTTP to the back-end servers.

And from more manual pages:

HTTP Listener
RewriteLocation 0|1|2
If 1 force Pound to change the Location: and Content-location:
headers in responses. If they point to the back-end itself or to
the listener (but with the wrong protocol) the response will be
changed to show the virtual host in the request. Default: 1
(active). If the value is set to 2 only the back-end address is
compared; this is useful for redirecting a request to an HTTPS
listener on the same server as the HTTP listener.