4

If I would like to setup HTTPS on all pages (Frontend and Backend) which would be the best approach?

For now using Apache 2.4 on CentOS 7 I have setup the following in VirtualHost:

VirtualHost *:80
        ServerName www.magentotest.dev
        ServerAlias www.magentotest.dev
        DocumentRoot /var/www/magento/
        ErrorLog /var/log/magentotest/error.log
        CustomLog /var/log/magentotest/access.log combined

        Redirect / https://www.magentotest.dev/
/VirtualHost

VirtualHost *:443
        ServerName www.magentotest.dev
        SSLEngine on

        SSLCertificateFile /etc/ssl/certs/magentotest.crt
        SSLCertificateKeyFile /etc/ssl/certs/magentotest.key

        DocumentRoot /var/www/magento/
        ErrorLog /var/log/magentotest/ssl.log
        CustomLog /var/log/magentotest/ssl.log combined
/VirtualHost

After doing this I visited Magento frontend which was totally messy, after a quick inspection on the source code I have seen that the browser was correctly redirecting HTTP to HTTPS but all the URL of the website was pointing to HTTP.

So I login to the backend and set HTTPS for both SECURE and UNSECURE URL in store settings, flush the cache and tried again, everything now appear to be correct and working.

From this setup I have a few questions:

  1. Is this the correct way to setup HTTPS for every page (Frontend and Backend)?
  2. Setting the UnsecureBaseURL in the backend to HTTPS I expected a slow performance on Frontend, correct me if I'm wrong but with this setup Apache is pointing the user to HTTPS, while Magento take the request, process it with PHP which answer GO to HTTPS right? I mean there is a way to avoid using Magento Secure/UnsecureBASE and tell Magento to point just to HTTPS and forget everything else?

Thanks Marcos

Improve this question

1 Answer 1

Reset to default
4

Your VirtualHost configuration is basically correct.

As you alluded to yourself, you will need to set the unsecurebaseurl (and securebaseurl) to be https. Magento uses the unsecure urls for basically everything it doesn't explicitly consider secure, however there is no reason why you can't have these pointing to https also.

EDIT: The only other thing to consider is the FPC. Magento is designed to allow you to use Varnish for this, however Varnish isn't capable of being an SSL Terminator, meaning you'd need either a Load Balancer or another reverse proxy such as nginx to sit in-front of it. Your stack can get quite a lot more complicated, quite quickly.

Improve this answer
8
  • Thank you Peter, infact I didn't thought about Varnish issue, I have read the documentation yestarday and even in the latest 4 version they don't support HTTPS. Today I will make this experiment, creating a CentOS 7 server with Varnish and Nginx on it, basically Varnish will handle cache and Nginx will act as a proxy so will not handle magento directly or any php but just the HTTPS request that pass to Varnish. With this setup my question is how I force HTTPS? Since I have understand that Varnish must call Apache on port 80 not 443.
    – Marcos Lamba
    Commented May 24, 2016 at 7:24
  • 1
    Set-up nginx to listen on port 443 and decrypt the traffic and pass the traffic on to varnish, then setup Apache to listen on port 8080 and set it up as the varnish backend. In your Apache VirtualHosts add SetEnv HTTPS on to trick Magento into thinking it's a secure request. Then just configure both the secure and unsecure URLs to be https and you should be good. For the http > https redirect you can listen on port 80 with either nginx or Apache to perform the redirect.
    – Peter O'Callaghan
    Commented May 24, 2016 at 9:11
  • Hi Peter I update with my tests. I have created a third server infront of the the two that I have (01 - MySQL, 02 - Apache, 03 Varnish + Nginx). I inform you that I have also found a good documentation about Hitch which correct me if I'm wrong was created by Varnish team to solve the SSL issue. On the third server I installed Varnish 4.1.2, Nginx 1.9.15 and Hitch 1.2.0. I configured Varnish to listen on port 80 and installed the VCL file retrieved from Magento backend, I set Apache to listen on 8080, and configured Nginx as a proxy on port 443 that point to localhost:80 where Varnish answer
    – Marcos Lamba
    Commented May 24, 2016 at 17:28
  • as last change I pointed the local DNS from Apache to Varnish server so I'm targeting Varnish when I visit www.magentotest.dev in the browser. Until here appear to be working if I inspect the network calls in Google Chrome Inspector tool I can see as first visit content get downloaded and second visit cached (Size column). But I found two problems, analyzing the headers I cannot find evidence that Magento is using Varnish plus I found another issue if I try to visit the Magento backend or any HTTPS page the browser hang with an error "redirected you too many times."
    – Marcos Lamba
    Commented May 24, 2016 at 17:32
  • I've not yet spent much time with M2. I'm not sure if it leaves any evidence in terms of headers that it is being cached. If everything is loading and you're pointing it varnish, it is likely working. Try checking the redirect chain by looking in the network tab of chrome or curl -I http://youradmindomain.com/youradminpath and see what the redirect is. It's likely http > https. Try `SELECT * FROM core_config_data where value like http%'; and look for your domain with a http not https path. May have custom row for admin panel.
    – Peter O'Callaghan
    Commented May 25, 2016 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.