We have a webapp that is build to use SSL for certain (but not all) types of req

Question

We have a webapp that is build to use SSL for certain (but not all) types of requests. The webapp is using multiple subdomains, the number can change. This combination of features makes that the webapp requires a wildcard SSL certificate.

The webapp is used by some people, but not by a whole lot of them. We would like to keep the webapp running for those who use it, but has been determined that, at this point in time, it is not economically justifiable to pay for the wildcard certificate.

Since the webapp has no build-in method to drop the SSL-requirement (or more precisely, the webapp expects 'SSL-traffic' to be comming in through a separate vhost listening to the same subdomain), I thought that the easiest solution would be to just disable the SSL and keep (unecrypted) traffic running over port 443.

My big question is:
is it a bad idea to run non-SSL traffic over port 443 (and why)?

Explanation / Answer

That doesn't sound terribly easy to me. Clients (and I assume we're talking about browsers here) expect http traffic to be served over port 80, and https traffic over 443. In order to change this to http over 443, that's going to require that you change your URL scheme to http, and then explicitly specify the port on each URL.

So, for an https URL like this: https://example.com/some-resource you will have to change it to: http://example.com:443/some-resource.

It seems to me that if you want to remove the SSL requirement, it would be easier to leave http running on port 80 so the only change you have to make to your URLs would be to remove the s from the scheme.

If you're wondering if you can serve http traffic directly to a client that is making an https request, allowing you to leave the URL the same, no, that should not work. The client is going to try to initiate a TLS handshake and when it doesn't get a TLS response, the connection will fail.

Related Questions

Navigate

• Browse (All)
• Browse W
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.