3

I have a LAMP webserver, and on it there is https://sslhosting.cz/ domain.

First I attach a general Let's Encrypt config file, which I changed to my needs:

/etc/letsencrypt/options-ssl-apache.conf

# Baseline setting to Include for all Let's Encrypt SSL sites


SSLEngine               on


# Intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3
SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDH$
SSLHonorCipherOrder     on
SSLCompression          off
SSLOptions              +StrictRequire


# Add vhost name to log entries:
LogFormat               "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat               "%v %h %l %u %t \"%r\" %>s %b" vhost_common


#CustomLog              /var/log/apache2/access.log vhost_combined
#LogLevel               warn
#ErrorLog               /var/log/apache2/error.log


# Always ensure Cookies have "Secure" set (JAH 2012/1)
#Header                 edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"


# HSTS = HTTP Strict Transport Security
Header                  always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" env=HTTPS
Header                  always set X-Frame-Options DENY


# OCSP Stapling
SSLCACertificateFile    /etc/apache2/certificates/letsencrypt-crosssigned-stapling.pem
SSLUseStapling          on

Do I need to have port 80 configured in Virtualhost for an HTTPS website? Note that I want HTTP to be redirected to HTTPS.

Follows the specific website config:

/etc/apache2/sites-available/sslhosting.cz-le-ssl.conf

<VirtualHost *:80>

  ServerName             sslhosting.cz
  ServerAlias            www.sslhosting.cz

  RewriteEngine          on

  RewriteCond            %{HTTPS} !on
  RewriteRule            ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L]

  RewriteCond           %{HTTP_HOST} ^www\.sslhosting\.cz
  RewriteRule           ^(.*)$ https://sslhosting.cz/$1 [R=301,L]

</VirtualHost>


<IfModule mod_ssl.c>

        <VirtualHost *:443>

                ServerAdmin     admin@vlastimilburian.cz

                ServerName      sslhosting.cz
                ServerAlias     www.sslhosting.cz

                DocumentRoot    /var/www/sslhosting.cz/public_html
                ErrorLog        ${APACHE_LOG_DIR}/error.log
                CustomLog       ${APACHE_LOG_DIR}/access.log combined

                SSLCertificateFile      /etc/letsencrypt/live/sslhosting.cz/fullchain.pem
                SSLCertificateKeyFile   /etc/letsencrypt/live/sslhosting.cz/privkey.pem

                Include         /etc/letsencrypt/options-ssl-apache.conf

        </VirtualHost>

        SSLStaplingCache        shmcb:/tmp/stapling_cache(128000)

</IfModule>

Now, the question:

Do I need to have port 80 configured in LAMP for an HTTPS website?

Vlastimil Burián
  • 499
  • 6
  • 20

1 Answers1

11

The answer to your titled question "Do I need to have port 80 configured in LAMP for an HTTPS website?" is no, you don't. You can run a LAMP stack on whatever port you would like. Common choices include 80,443 (SSL/TLS), 8080, 8000, etc.

Inside the question, you add a wrinkle which changes the answer a bit.

"Note that I want HTTP to be redirected to HTTPS."

If you want your webserver to do that redirection, and if you assume the standard http port 80/tcp, then the answer becomes yes. You need to have port 80 configured to complete the redirection.

For completeness sake, I can think of a few other ways to get to a working config that do not rely on port 80 on your webserver.

One is to use a load balancer out in front that would handle the redirection.

Two is to use iptables to redirect the port. Note, this won't quite handle the SSL/TLS requirement in your case.

dmourati
  • 25,540
  • 2
  • 42
  • 72
  • 1
    Also Let's Encrypt needs port 80 open if you use the http-01 challenge. – zhenech Apr 14 '16 at 05:57
  • option 3 could be a rewrite rule `Redirect "/" "https://example.com/"` so you redirect everything from port 80 to 443 by the webserver itself – Koen van der Rijt Apr 14 '16 at 08:52
  • 3
    @KoenvanderRijt ... and how is the browser supposed to get the http-packet containing the redirect to port 443, if the server doesn't listen on port 80 in the first place? ;-) – s1lv3r Apr 14 '16 at 11:49
  • 4
    Also, If you're going to do an HTTP -> HTTPS redirection, you really should also have a look at HSTS, and implement the headers it requires. Recent browsers support that spec, and after one HTTP connection, they will always try to contact your site in HTTPS. – LordOfThePigs Apr 14 '16 at 12:06