Ask Questions and Find Answers
Important:
Ask is now read-only. You can review any existing questions and answers, but not add anything new.
But - don't panic! While ask is no more, we've replaced it with discuss - the new Liferay Discussion Forum! Read more here here or just visit the site here:
discuss.liferay.com
RE: how redirect all request from domains to https except one domain?
hi
i buy ssl certificates for multi domains and set for those and config all request redirect to https in tomcat web.xml file:
<security-constraint>
<web-resource-collection>
<web-resource-name>Entire Application</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
but i don't want one domain auto redirect to https (because i don't buy certificate for that domain).
how can i except one domain that not redirect automatically to https?
thanks
i buy ssl certificates for multi domains and set for those and config all request redirect to https in tomcat web.xml file:
<security-constraint>
<web-resource-collection>
<web-resource-name>Entire Application</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
but i don't want one domain auto redirect to https (because i don't buy certificate for that domain).
how can i except one domain that not redirect automatically to https?
thanks
I guess, the cheapest way is to buy certificates and send everything to https.
But I really recommend that you place a reverse proxy before the app server. It allows you to have a lot more flexibility. In a reverse proxy you could have one configuration per site to redirect or not, it also can handle multiple certificates and it also makes it easier to switch the certificates since no Liferay restart is needed.
You can also use tools like letsencrypt to automatically generate certificates and would not even have to buy them.
But I really recommend that you place a reverse proxy before the app server. It allows you to have a lot more flexibility. In a reverse proxy you could have one configuration per site to redirect or not, it also can handle multiple certificates and it also makes it easier to switch the certificates since no Liferay restart is needed.
You can also use tools like letsencrypt to automatically generate certificates and would not even have to buy them.
i don't believe tomcat not support this feature, this a public require!!
mokhtar hatampoor:
Tomcat absolutely supports running behind a reverse proxy, plus it's best practice to do so anyway. Go that route and you get the other advantages that Christoph mentioned for free.
i don't believe tomcat not support this feature, this a public require!!
Well, it isn't really the goal/purpose of Tomcat to do these things. The Tomcat connector component (Coyote) just isn't designed to allow you to manage multiple domains, certificates, redirects and several other things. It can do some of them to some degree, but it isn't nearly as powerful as e.g. Apache or Nginx which excel at these things.
For this reason a lot of people, myself included, always place a reverse proxy in front of Tomcat. In the last couple of years I just once didn't do that and of course, I regretted it later on when a new requirement came up that would have been trivial to solve with an Apache in front of the Tomcat servers.
For this reason a lot of people, myself included, always place a reverse proxy in front of Tomcat. In the last couple of years I just once didn't do that and of course, I regretted it later on when a new requirement came up that would have been trivial to solve with an Apache in front of the Tomcat servers.
thanks for replies
what is your suggestion for reverse proxy? nginx or others?
what is your suggestion for reverse proxy? nginx or others?
mokhtar hatampoor:
Whatever you're comfortable with and know how to administer safely (and prepare for disaster recovery), or whatever you might have running anyway.
what is your suggestion for reverse proxy? nginx or others?
For me that's Apache httpd, but that doesn't have anything to say. nginx is fine as well - I "just grew up" with httpd.
Tough choice. Between Nginx and Apache it's like "Do I take the Ferrari or the Porsche?" ;)
In the end, I would look for tutorials in the Internet and once you have found a nice one, stick with it. I have used both Nginx and Apache and both are exceptional servers with different strengths. The module system of Apache is more convenient and thus there are more interesting plugins out there, also it supports AJP out of the box, which is a boon when connecting Tomcat.
On the other hand, Nginx is faster in general and has a MUCH cleaner syntax.
Oh: And in case your servers are on Windows: Use Apache. Even the official documentation does not recommend using Nginx on Windows. You could use IIS there, it works, but IIS isn't really a good reverse proxy.
In the end, I would look for tutorials in the Internet and once you have found a nice one, stick with it. I have used both Nginx and Apache and both are exceptional servers with different strengths. The module system of Apache is more convenient and thus there are more interesting plugins out there, also it supports AJP out of the box, which is a boon when connecting Tomcat.
On the other hand, Nginx is faster in general and has a MUCH cleaner syntax.
Oh: And in case your servers are on Windows: Use Apache. Even the official documentation does not recommend using Nginx on Windows. You could use IIS there, it works, but IIS isn't really a good reverse proxy.
Copyright © 2025 Liferay, Inc
• Privacy Policy
Powered by Liferay™