logo
Apache Lounge
Webmasters

 

About Forum Index Downloads Search Register Log in RSS X


Keep Server Online

If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.

or

Bitcoin

A donation makes a contribution towards the costs, the time and effort that's going in this site and building.

Thank You! Steffen

Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
Post new topic   Forum Index -> Apache View previous topic :: View next topic
Reply to topic   Topic: Enable HTTP Strict Transport Security
Author
iCone



Joined: 11 Jul 2016
Posts: 2

PostPosted: Mon 11 Jul '16 18:39    Post subject: Enable HTTP Strict Transport Security Reply with quote

After installing owncloud on one of our Centos 6 servers I'm trying to make a change to our web server configuration as per the owncloud admin guides in order to increment the max-age to 15768000.

Inserted the following lines to the httpd.conf:
<VirtualHost *:443>
ServerName cloud.xxxxxxxxxx.com
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
</IfModule>
</VirtualHost>

But Apache fails to start, get this message:
[Mon Jul 11 10:57:33 2016] [warn] _default_ VirtualHost overlap on port 443, the first has precedence

Looked a bit and seems that ssl.conf is the guilty party, what do I need to to in order to make this work while keeping SSL active?
Back to top
gijs



Joined: 27 Apr 2012
Posts: 189
Location: The Netherlands

PostPosted: Tue 12 Jul '16 1:22    Post subject: Reply with quote

That error indicates that there is another web site running on port 443. (The default one?)

It has nothing to do with http strict transport security.
Back to top
Jan-E



Joined: 09 Mar 2012
Posts: 1248
Location: Amsterdam, NL, EU

PostPosted: Tue 12 Jul '16 10:48    Post subject: Re: Enable HTTP Strict Transport Security Reply with quote

You only have to insert these lines into your existing virtualhosts:
Code:
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
</IfModule>

Do not add new virtualhosts.
Back to top
iCone



Joined: 11 Jul 2016
Posts: 2

PostPosted: Tue 12 Jul '16 17:07    Post subject: Re: Enable HTTP Strict Transport Security Reply with quote

Worked, thanks!!!
Back to top


Reply to topic   Topic: Enable HTTP Strict Transport Security View previous topic :: View next topic
Post new topic   Forum Index -> Apache