Subject: RE: securing one area of a vhost in apache 2

From: [email-masked]
Date: Fri, 28 Feb 2003 10:39:38 -0000

> -----Original Message-----
> From: Nick Tonkin [mailto:[email-masked]]
> Sent: 27 February 2003 21:01
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: securing one area of a vhost in apache 2
> 
> 
> On Thu, 27 Feb 2003, Mads Toftum wrote:
> 
> > On Thu, Feb 27, 2003 at 12:52:06PM -0800, Nick Tonkin wrote:
> > > nick@world ~>lwp-request -sSed 
> https://www.ladyraquel.com:8080/secure/
> > > GET https://www.ladyraquel.com:8080/secure/ --> 501 
> Protocol scheme 'https' is not supported
> > > ## huh?!
> 
> > This looks very much like a client error from lwp. You need
> > Crypt::SSLeay for that, see:
> > http://search.cpan.org/author/CHAMAS/Crypt-SSLeay-0.49/
> 
> I'm sorry, for what? For requesting https?
> 
> - nick
> 
Have you tried requesting these pages another way, eg with a browser or even
curl (http://curl.haxx.se)? Like Mads says, it does look to be a client
error.

- 
John Airey, BSc (Jt Hons), CNA, RHCE
Internet systems support officer, ITCSD, Royal National Institute of the
Blind,
Bakewell Road, Peterborough PE2 6XU,
Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 [email-masked] 

A world of difference - in the UK, 37 million people put their faith on the
last census as "Christian". In Saudi Arabia, this answer would carry a death
sentence for any Saudi.

- 

NOTICE: The information contained in this email and any attachments is 
confidential and may be legally privileged. If you are not the 
intended recipient you are hereby notified that you must not use, 
disclose, distribute, copy, print or rely on this email's content. If 
you are not the intended recipient, please notify the sender 
immediately and then delete the email and any attachments from your 
system.

RNIB has made strenuous efforts to ensure that emails and any 
attachments generated by its staff are free from viruses. However, it 
cannot accept any responsibility for any viruses which are 
transmitted. We therefore recommend you scan all attachments.

Please note that the statements and views expressed in this email 
and any attachments are those of the author and do not necessarily 
represent those of RNIB.

RNIB Registered Charity Number: 226227

Website: http://www.rnib.org.uk 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Nick Tonkin <[email-masked]>
Date: Sat, 1 Mar 2003 08:12:03 -0800 (PST)

Thanks to all who responded on this question.

[ I am now using curl -k to test my self-certified SSL connections :) ]

I have also concluded that the standard way to have one `section' of a
site handled via SSL is to actually have a separate VirtualHost ... maybe
this is obvious but I don't think the documentation made it so. In
particular, I think
http://httpd.apache.org/docs-2.0/ssl/ssl_faq.html#vhosts2 should be placed
more prominently in an introduction area.

Anways, I now have a separate virtual host listening on 443 and serving
https. It is supposed to be only used for the /secure directory, so I am
trying various methods of dealing with relative links, images, etc.

I wanted to build a mod_perl PerlPostReadRequest URI translation
handler to switch back and forth between protocols, but there's a bug or
something with APR::URI at the minute so that attempt is on hold.

I used the recommended mod_rewrite recipe
(http://httpd.apache.org/docs-2.0/ssl/ssl_faq.html#relative) but didn;t
like the extra taglet on the end of my tags (they already get processed by
TT2 and sometimes other stuff), so I went with:

    RewriteCond  %{REQUEST_URI}  !/secure/
    RewriteRule  ^/(.*)$   http://www.ladyraquel.com:8080/$1 [R,L]

in the secure server and

    RewriteCond  %{REQUEST_URI}  /secure/
    RewriteRule  ^/(.*)$   https://secure.ladyraquel.com:8443/$1 [R,L]

in the plain one.

HOWEVER, in both cases I encountered problems with Netscape Navigator 4.08
warning about the >redirect< to the non-secure page. Any suggestions about
this?

Thanks,

- nick

-- 

~~~~~~~~~~~~~~~~~~~~
Nick Tonkin   {|8^)>