Project

General

Profile

https not working on custom port

Added by john almost 8 years ago

I tried to change port to 454, it does not work with ssl, with http it works fine, not working working with https
change both in condition and server port to 454

http://192.168.22.157:454 -> working
https://192.168.22.157:454 -> not working

on 80 port both working
http://192.168.22.157
https://192.168.22.157

I have this code working ok on port :80, http to https direct only works fine

$SERVER["socket"] == ":80" {
  $HTTP["host"] =~ "(.*)" {
    url.redirect = ( "^/(.*)" => "https://%1/$1" )
  }
}

$SERVER["socket"] == ":443" {
    ssl.engine = "enable" 
    ssl.pemfile = "/usr/local/ssl/cert.pem" 
}

Replies (7)

RE: https not working on custom port - Added by john almost 8 years ago

I added just these 2 lines, without any condition

ssl.engine = "enable"
ssl.pemfile = "/usr/local/ssl/cert.pem"

now https working fine, but http not opening

on http, i just need redirect to https

please help

RE: https not working on custom port - Added by gstrauss almost 8 years ago

So you're saying this doesn't work? Note that I updated the redirect as well in the config below.
(Leave server.port alone, or at least don't set it to 454 unless the main server has ssl.engine = "enable" and the ":80" condition contains ssl.engine = "disable")

$SERVER["socket"] == ":80" {
  $HTTP["host"] =~ "(.*)" {
    url.redirect = ( "^/(.*)" => "https://%1:454/$1" )
  }
}

$SERVER["socket"] == ":454" {
    ssl.engine = "enable" 
    ssl.pemfile = "/usr/local/ssl/cert.pem" 
}

RE: https not working on custom port - Added by john almost 8 years ago

http://192.168.22.162 this also redirects to https://192.168.22.162:454/
https://192.168.22.162:454/ this works fine

http://192.168.22.162:454 does not redirects to https://192.168.22.162:454/

also if there any way to echo or log to file, to test, if condition really works
https://redmine.lighttpd.net/projects/1/wiki/docs_configuration

e.g
$SERVER["socket"] == "http"{
echo "herer" or log or debug to file to see if condition really works
}

RE: https not working on custom port - Added by gstrauss almost 8 years ago

Your comparisons are very much wishful thinking. For example, $HTTP["scheme"] can be checked for "http". "http" is not a "socket".
Please refer to the documentation about valid comparisons to conditionals.
https://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_Configuration

.

http://192.168.22.162:454 does not redirects to https://192.168.22.162:454/

http and https protocols are very, very different. One is encrypted and one is not.
Neither Apache nor lighttpd supports both protocols on the same port.
However, nginx can do it:
http://serverfault.com/questions/47876/handling-http-and-https-requests-using-a-single-port-with-nginx
http://stackoverflow.com/questions/15429043/how-to-redirect-on-the-same-port-from-http-to-https-with-nginx-reverse-proxy
http://nginx.org/en/docs/http/ngx_http_core_module.html#error_page

In any case, it would appear that the real source of your problem is whatever is generating http://192.168.22.162:454 is what needs to be fixed. Whatever generates a URL to port 454 should generate the https://...:454

RE: https not working on custom port - Added by gstrauss almost 8 years ago

Please note that TLS is a socket-level protocol, and the encrypted channel is negotiated on the socket before the application-level HTTP request is parsed, so things like scheme and url are not available at the point where TLS is exchanging encryption keys.

RE: https not working on custom port - Added by john almost 8 years ago

thanks for explaining deeply

If there any patch for source code to apply or any modification, or i can read more about this, I have good knowledge of c coding
so, it listen both protocols on same port and redirect http to https ?

RE: https not working on custom port - Added by gstrauss almost 8 years ago

I have not looked at the nginx code, but presume that nginx is attempting to negotiate TLS on the socket, and if that fails, it returns a custom error code internally (nginx doc says it uses 497), for which the admin can send a custom error document. That error document could be the redirect you seek.

The reason this might work is that when TLS fails, the server has the choice of closing the socket or sending "something" back to the client. If the client expected TLS, then a clear-text HTTP response will be garbage to the client, but if the client tried clear-text HTTP, then the error document could be a redirect to the https:// site.

    (1-7/7)