Configuring SSL

Question

I'm using Drupal 6 and already set the SSL Certificate (with my own Certificate Authority) configuration of my apache server, and added the following redirection in Drupal .htaccess file.

RewriteCond %{SERVER_PORT} !^443$  
RewriteRule ^test/home https://localhost/test/home [R=301,L]

When I try to access http://test/home it redirects to https://test/home correctly, but it shows a 404 error.

Not Found

The requested URL /test/home was not found on this server.
Apache/2.2.9 (Ubuntu) PHP/5.2.6-2ubuntu4.6 with Suhosin-Patch mod_ssl/2.2.9 OpenSSL/0.9.8g Server at localhost Port 443

Moreover, the secure pages module doesn't allow to enable secure pages.

Is there any configuration problem? Please guide me.

Answer 1

I'm assuming you're hosting this on your own server? I had the same issue. It ended up being a problem with my Vhost definition in Apache. There are separate vhost definitions for http and https access (I'm not an Apache ninja, so this may not be the most efficient way, but it worked). Make sure your SSL vhost is pointing to the same directory as your normal vhost. It seems like its trying to pull your site from a different directory on your server.

After you check that, click the link in "If this test has failed then go here".

Also, you shouldn't have to use an .htaccess rewrite if you're using the Secure Pages module.

Answer 2

There are separate vhost definitions for 80 and 443 as Chaulky points out. Apache setup is a little more complicated when dealing with SSL. Your vhosts should be something like this:

<VirtualHost *:80>
  ServerAdmin [email protected]
  ServerName www.example.com
  ServerAlias example.com
  DocumentRoot /var/www/drupal6

  <Directory /var/www/drupal6>
                Options -Indexes FollowSymLinks MultiViews
                AllowOverride All
                Order allow,deny
                allow from all
        </Directory>

  ErrorLog /var/log/apache2/error_example.com.log
  CustomLog /var/log/apache2/access_example.com.log combined
  ServerSignature On

  # Possible values include: debug, info, notice, warn, error, crit,
  # alert, emerg.
  LogLevel warn
</VirtualHost>

<VirtualHost *:443>
  ServerAdmin [email protected]
  ServerName example.com
  ServerAlias www\.example\.com
  DocumentRoot /var/www/drupal6

  <Directory /var/www/drupal6>
    Options -Indexes FollowSymLinks MultiViews
    AllowOverride All
    Order allow,deny
    allow from all
  </Directory>

  ErrorLog /var/log/apache2/error_example.com.log
  CustomLog /var/log/apache2/access_example.com.log combined
  ServerSignature On

  # Possible values include: debug, info, notice, warn, error, crit,
  # alert, emerg.
  LogLevel warn

  # Put SSL stuff in here
</VirtualHost>

So you have one for port 80 and one for port 443.

Check your ports.conf to make sure that you have something like:

  Listen 443

Unless you have a good reason not to, I would ditch the securepages module altogether and just run the entire site in SSL mode. By the look of the rule in your .htaccess, that's what you're trying to do anyway.

If you wanted to redirect all non-secure traffic to secure, you could use this version of the non-secure vhost:

<VirtualHost *:80>
  ServerAdmin [email protected]
  ServerName www.example.com
  ServerAlias example.com
  DocumentRoot /var/www/drupal6
  Redirect / https://www.example.com

  ErrorLog /var/log/apache2/error_example.com.log
  CustomLog /var/log/apache2/access_example.com.log combined
  ServerSignature On

  # Possible values include: debug, info, notice, warn, error, crit,
  # alert, emerg.
  LogLevel warn
</VirtualHost>

Bit of a long one, sorry, but hopefully this is what you're looking for!