How to switch to/from HTTPS using Apache as a proxy to Tomcat

Posted on by

I’m writing this down because it too me an age to figure out a way of doing this. I have a website which Tomcat is happily serving. Areas of the site require a secure connection so I’m using Spring security to require particular URLs to be accessed over HTTPS. It means that when I access http://example.org:8080/webapp/login, it’ll bump me to https://example.org:8443/webapp/login. Note: Tomcat is setup with the SSL connector and a self signed .keystore see (http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html).

I have two vhosts setup in Apache, one for the http://example.org and one for https://example.org. They are both using mod_proxy to ProxyPass and ProxyPassReverse requests to the appropriate Tomcat URL’s. The problem comes when switching to HTTPS from HTTP and vice versa. Ideally I wanted some sort of ProxyPassReverse declaration in my config for http://example.org what would change HTTP headers (that Spring sets) for https://example.org:8443/webapp into https://example.org. Except ProxyPassReverse doesn’t work like that.

Now, I realise I could simply not use Spring to manage which parts of the site should be accessed over HTTPS and which should not…and just setup Apache to redirect as appropriate. I don’t want to do that though, because that makes the task of adding these restrictions a deploy time task, rather than a development time task. I don’t want to risk someone forgetting to add new restrictions when deploying the webapp and I’d much rather the developer added these restrictions when they were working on the task and really thinking about where and when they are needed.

So, how do I solve the problem so that the app can manage its secure-ness and I can setup Apache once and forget about it? The answer is to ProxyPassReverse onto a “special” URL, which when accessed will redirect to the HTTPS (or HTTP) site. For example, if the HTTP site needed to redirect to the HTTPS site, I’d add rules like so to perform the redirect:

    # Proxy a request (from the server) to switch to https onto a special URL "/2https/"
    ProxyPassReverse /2https/ https://example.org:8443/webapp/

    # When a client requests a URL prefixed with "/2https" map it onto the secure site
    RewriteRule ^/2https/(.*)$ https://example.org/$1 [R,L]

…and you’d add something similar to the secure site Apache config. As long as I don’t mount any pages at /2http or /2https I should be ok. Note a couple of things:

  • You’ll need “SSLProxyEngine on” and “RewriteEngine on” and obviously the appropriate Apache modules loaded for these commands.
  • Because of the redirect between HTTP <-> HTTPS you won’t be able to POST data between them directly (I’m not sure why you’d NEED to though)
  • Obviously you’ll need to setup Apache with an SSL certificate…but that is a different story

I should say a special thanks to this random site – from whence the idea actually came from. If anyone has any better ideas on how to do it I’d love to hear them. Please comment below.

10,670 thoughts on “How to switch to/from HTTPS using Apache as a proxy to Tomcat”

  4. continuously i used to read smaller posts that also clear their motive, and that is also happening with this piece of writing which I am
    reading at this place.

  23. wettquote bielefeld leverkusen

    Also visit my blog post; ncca basketball wett vorhersagwn übertore untertore (Clay)

  35. The Aloha! slot machine Cluster Pays was released on gaming platforms at the end of March 2016. This is a bright slot machine developed by the famous Swedish provider NetEnt. The first thing that Canadian users will appreciate at the start of the game is the colorful gameplay design in the style of the Hawaiian Islands, bright animation and soundtrack of the gameplay. This game can be accessed only after verifying your age. Free games are still available in some online casinos. We all know there is nothing more frustrating than triggering a slot bonus round and then winning nothing at all. That will never be the case with Aloha! Cluster Pays as your free spins will continue until a winning combination is landed. Have a tiki time and create juicy clusters on all of your favourite iOS and Android devices. Play Aloha! Cluster Pays in both portrait and landscape mode with lightning-fast load times and full mobile optimisation meaning all features, including the session timer and spin button, are always on-screen however you play.
    https://kuljetus.jdmmediagroup.com/2026/03/13/royal-reels-7-bonus-review-australian-players-guide/
    Grandx Casino Login App Sign Up There are top casinos bookmakers in the UK that offer free play and paid options for this slot, either through demo modes or as part of promotional bonuses like free spins. Let’s explore these casinos in more details and discover where to play the Big Bass Bonanza slot in the UK. Many UK casinos offer welcome bonuses and free spins as well as Drops & Wins tournaments, which will give you a chance to play this slot – and sometimes those free spins even apply directly to Big Bass Bonanza! Just make sure to check the T&Cs, because not all offers will be for specific slots. How is the TrustScore calculated? Get ready to reel in a big catch with Big Bass Bonanza, the thrilling slot game brought to you by Pragmatic Play! With its 5-reel, 3-row layout, this game combines the excitement of fishing with the chance to score huge payouts. 

  36. Slots 40 Line Slots With dynamic reels that are constantly changing, Megaways games offer a unique and intense gaming experience where each round is different from the other. Are you ready to triple your fun and triple your winnings? Because Joker Trio slot machine from iSoftBet offers a 2,500 coin on-progressive jackpot to players who manage to charm the Joker to give up his wealth. Geniesse über 2’000 der besten Casino-Spiele\n \n Entdecke wöchentlich neue Spiele mit regelmässigen Slot-Turnieren.\n With the many different slots Vegas Moose has to offer both new players and our seasoned players they can all find a game just for them. Always keep an eye out for special promotions when playing on our UK online casino, since they often provide additional value when trying out select slots. Often giving away free spins and that’s on top of our 100 free spins daily!
    https://futurehomes.net.in/2026/03/16/jackpot-jill-free-spins-code-how-to-redeem-in-australia-2/
    We believe transparency builds trust, so every prediction we publish is tracked. You can view each writer’s overall and monthly records by clicking their name in any preview or on the writers page. The bonus system itself has strong strategic implications. Because the triggering number’s star rating directly affects how many columns of multiplier bricks are counted, the Super Stake becomes more than just a chance at more bonus numbers — it’s your gateway to the higher potential payout zones. In essence, the game allows players to control their own volatility. If you’re just spinning casually, you can opt out of Super Stake and play a more traditional, low-risk game. If you’re chasing the 4,999x dream, you’ll want that full grid of gold and red numbers covered. You want a Stake review that gives you all of the details? Well, look no further. My review can tell you exactly why Stake is the best online casino and sportsbook.

  42. We’re a group of volunteers and starting a brand new scheme in our community.
    Your web site provided us with valuable information to work on. You’ve done an impressive activity and
    our entire neighborhood will likely be grateful to you.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>