how redirect all request from domains to https except one domain?

thumbnail
mokhtar hatampoor, modified 5 Years ago. Junior Member Posts: 32 Join Date: 12/27/07 Recent Posts
hi
i buy ssl certificates for multi domains and set for those and config  all request redirect to https in tomcat web.xml file:
    <security-constraint>
        <web-resource-collection>
        <web-resource-name>Entire Application</web-resource-name>
        <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>
but i don't want one domain auto redirect to https (because i don't buy certificate for that domain).
how can i except one domain that not redirect automatically to https?
thanks
thumbnail
Christoph Rabel, modified 5 Years ago. Liferay Legend Posts: 1555 Join Date: 9/24/09 Recent Posts
I guess, the cheapest way is to buy certificates and send everything to https.
But I really recommend that you place a reverse proxy before the app server. It allows you to have a lot more flexibility. In a reverse proxy you could have one configuration per site to redirect or not, it also can handle multiple certificates and it also makes it easier to switch the certificates since no Liferay restart is needed.
You can also use tools like letsencrypt to automatically generate certificates and would not even have to buy them.
thumbnail
mokhtar hatampoor, modified 5 Years ago. Junior Member Posts: 32 Join Date: 12/27/07 Recent Posts
i don't believe tomcat not support this feature, this a public require!!
thumbnail
Olaf Kock, modified 5 Years ago. Liferay Legend Posts: 6441 Join Date: 9/23/08 Recent Posts
mokhtar hatampoor:

i don't believe tomcat not support this feature, this a public require!!
Tomcat absolutely supports running behind a reverse proxy, plus it's best practice to do so anyway. Go that route and you get the other advantages that Christoph mentioned for free.
thumbnail
Christoph Rabel, modified 5 Years ago. Liferay Legend Posts: 1555 Join Date: 9/24/09 Recent Posts
Well, it isn't really the goal/purpose of Tomcat to do these things. The Tomcat connector component (Coyote) just isn't designed to allow you to manage multiple domains, certificates, redirects and several other things. It can do some of them to some degree, but it isn't nearly as powerful as e.g. Apache or Nginx which excel at these things.
For this reason a lot of people, myself included, always place a reverse proxy in front of Tomcat. In the last couple of years I just once didn't do that and of course, I regretted it later on when a new requirement came up that would have been trivial to solve with an Apache in front of the Tomcat servers.
thumbnail
mokhtar hatampoor, modified 5 Years ago. Junior Member Posts: 32 Join Date: 12/27/07 Recent Posts
thanks for replies
what is your suggestion for reverse proxy? nginx or others?
thumbnail
Olaf Kock, modified 5 Years ago. Liferay Legend Posts: 6441 Join Date: 9/23/08 Recent Posts
mokhtar hatampoor:

what is your suggestion for reverse proxy? nginx or others?
Whatever you're comfortable with and know how to administer safely (and prepare for disaster recovery), or whatever you might have running anyway.
For me that's Apache httpd, but that doesn't have anything to say. nginx is fine as well - I "just grew up" with httpd.
thumbnail
Christoph Rabel, modified 5 Years ago. Liferay Legend Posts: 1555 Join Date: 9/24/09 Recent Posts
Tough choice. Between Nginx and Apache it's like "Do I take the Ferrari or the Porsche?" ;)
In the end, I would look for tutorials in the Internet and once you have found a nice one, stick with it. I have used both Nginx and Apache and both are exceptional servers with different strengths. The module system of Apache is more convenient and thus there are more interesting plugins out there, also it supports AJP out of the box, which is a boon when connecting Tomcat.
On the other hand, Nginx is faster in general and has a MUCH cleaner syntax.
Oh: And in case your servers are on Windows: Use Apache. Even the official documentation does not recommend using Nginx on Windows. You could use IIS there, it works, but IIS isn't really a good reverse proxy.