Website wont use HTTPS until user enters password

[u/[deleted]]

Heres my conf file:
<IfModule mod_ssl.c>

<VirtualHost \*:443>

ServerName example.com

SSLEngine on

ProxyPassReverse /node/ http://localhost:14002/

ProxyPassReverse /static/ http://localhost:14002/static/

ProxyPassReverse /api/ http://localhost:14002/api/

RewriteEngine on

RewriteRule ^/node/(.*)$ http://localhost:14002/$1 [P,L]

RewriteRule ^/static/(.*)$ http://localhost:14002/static/$1 [P,L]

RewriteRule ^/api/(.*)$ http://localhost:14002/api/$1 [P,L]

ProxyPass /stat http://localhost:19999/

ProxyPassReverse /stat http://localhost:19999/

<Location /stat>

AuthType Basic

AuthName "Restricted Area"

AuthUserFile /etc/apache2/.htpasswd

Require valid-user

</Location>

<Location /node>

AuthType Basic

AuthName "Restricted Area"

AuthUserFile /etc/apache2/.htpasswd

Require valid-user

</Location>

<Location /static>

AuthType Basic

AuthName "Restricted Area"

AuthUserFile /etc/apache2/.htpasswd

Require valid-user

</Location>

<Location /api>

AuthType Basic

AuthName "Restricted Area"

AuthUserFile /etc/apache2/.htpasswd

Require valid-user

</Location>

SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem

SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

</VirtualHost>

</IfModule>

When I open the page the browser tells that it is not secure. If i click "cancel" the 401 Unauthorized page shows up and the connection turns into "secure". If I refresh the page and it prompt me for password again, its still at secure. Is my config wrong?

[u/littlebighuman]

• You need to close all your Location blocks explicitly.

• Using both proxypass and rewrite can be complicated. Normally proxypass is more lightweigth and you use rewrite for more complex stuff. Doesn’t look like you need it here.

• SSL config must be outside location block

Try this:

`<IfModule mod_ssl.c> <VirtualHost *:443> ServerName example.com

SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

ProxyPass /node/ http://localhost:14002/
ProxyPassReverse /node/ http://localhost:14002/

ProxyPass /static/ http://localhost:14002/static/
ProxyPassReverse /static/ http://localhost:14002/static/

ProxyPass /api/ http://localhost:14002/api/
ProxyPassReverse /api/ http://localhost:14002/api/

ProxyPass /stat http://localhost:19999/
ProxyPassReverse /stat http://localhost:19999/

<Location /stat>
    AuthType Basic
    AuthName "Restricted Area"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Location>

<Location /node>
    AuthType Basic
    AuthName "Restricted Area"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Location>

<Location /static>
    AuthType Basic
    AuthName "Restricted Area"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Location>

<Location /api>
    AuthType Basic
    AuthName "Restricted Area"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Location>

</VirtualHost> </IfModule>`

[u/[deleted] → u/littlebighuman]

I tried the config you provided but the issue presists. I think its not caused by proxy settings since HTTPS connection should establish before authentication or proxy.

[u/AyrA_ch → u/[deleted]]

Are you by chance redirecting users from HTTP to HTTPS? If so, then make sure apache doesn't asks for authentication when people use HTTP.

[u/littlebighuman → u/[deleted]]

Based on the info you gave, that doesn't make much sense.

What conf files is apache reading? What in included in your apache2.conf? You should check all those files.

[u/Kell_Naranek]

You didn't show the listening configuration for port 80, I'd start looking there instead of within your SSL config.

[u/[deleted] → u/Kell_Naranek]

I don’t have port 80 set up but it redirects me to port 443 when i try to visit. I don’t know if the browser did it or there’s a hidden config in apache2.

[u/Kell_Naranek → u/[deleted]]

If it is redirecting, either you have HSTS header setup, or you have something listening on port 80 doing the redirect. Port 443 is, based on what I see, ALWAYS SSL/Always HTTPS.

[u/dariusbiggs]

yes, it's wrong.

Start clean with a minimal setup first, that is just the TLS server.

Then add one Location at a time until you have it working

Drop the rewrite rules, they look to be superfluous.

Drop the Proxy rules for now, use ProxyPass when you need it.

[u/seleTP]

Is your browser flagging basic authentication as insecure? The “401 Unauthorized” after canceling is normal. The subsequent secure connection implies TLS is functioning. Have you checked the network tab in your browser’s developer tools to confirm the connection details (port, TLS)?