# How best to force SSL with application\_php and apache2 cookbooks?

**URL:** <https://discourse.chef.io/t/how-best-to-force-ssl-with-application-php-and-apache2-cookbooks/3745>\
**Category:** Chef Infra (archive)\
**Created:** [March 14, 2013, 5:55pm UTC](https://discourse.chef.io/t/how-best-to-force-ssl-with-application-php-and-apache2-cookbooks/3745 "2013-03-14T17:55:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pmocek](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@pmocek](https://discourse.chef.io/u/pmocek)\
**Post date:** [March 14, 2013, 5:55pm UTC](https://discourse.chef.io/t/how-best-to-force-ssl-with-application-php-and-apache2-cookbooks/3745/1 "2013-03-14T17:55:41Z")

</div>

What is the preferred method of configuring a Web application  
deployed via the [application\_php cookbook](http://community.opscode.com/cookbooks/application_php) to accept HTTP over  
SSL connections on port 443 and to redirect requests on 80 to 443?

I’m using application\_php with success, but it is [hard-coded to  
cause the http server to listen on 8080](https://github.com/opscode-cookbooks/application_php/blob/master/templates/default/php.conf.erb#L1). I don’t find any  
discussion of SSL or of alternative ports in documentation of the  
application\_php and application cookbooks or of the deploy  
provider. The apache2 cookbook docs show how to install mod\_ssl  
and to specify some cipher configuration, but as far as I can  
tell, none of that matters as long as application\_php is  
configuring Apache to do name-based virtual hosting on 8080. Web  
searches for relevant keywords have turned up nothing relevant.

References:

–  
Phil Mocek  
[http://mocek.org/](http://mocek.org/)

---

<div class="post-metadata">

**Author:** ![Ryan\_Walker](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/ryan_walker/32/391_2.png) [@Ryan\_Walker](https://discourse.chef.io/u/Ryan_Walker)\
**Post date:** [March 14, 2013, 6:09pm UTC](https://discourse.chef.io/t/how-best-to-force-ssl-with-application-php-and-apache2-cookbooks/3745/2 "2013-03-14T18:09:00Z")

</div>

I use an attribute in my cookbook that allows me to set the ports for HTTP and HTTPS and then have a template file for http and https configuration that uses this attribute directly. Then, when I call mod\_php\_apache2 within the application resource, I give it the HTTP template using "webapp\_template" (which could include the rewrites you want):

```
mod_php_apache2 do
  app_root "#{node['php_app']['public']}"
  webapp_template "app.conf.erb"
  server_aliases node["php_app"]["server_aliases"]
end

```

Then, outside of the application resource, I check to see if my deployment includes any SSL stuff and if so, I call the apache2 cookbook's web\_app resource directly to create the SSL configuration file and again give it my own template that is specific to my app using "template":

if node["php\_app"]["sslcert"] and node["php\_app"]["sslkey"]  
include\_recipe "apache2::mod\_ssl"

\<some stuff that creates the SSL key and cert files, but is really long, so I'm omitting them\>

```
web_app "#{node['php_app']['domain']}-ssl" do
  template "https_app.conf.erb"
  server_name node['domain']
  server_aliases node['php_app']['server_aliases']
  port node['php_app']['https_port']
  listen_ports [node['php_app']['http_port'], node['php_app']['https_port']]
  sslcert node["php_app"]["sslcert_file"]
  sslkey node["php_app"]["sslkey_file"]
  cacert ndoe["php_app"]["sslcacert_file"] if node["php_app"]["sslcacert_file"]
end

```

end

Inside the template files, I set the port with this:

HTTP:  
\<VirtualHost \*:\<%= node["php\_app"]["http\_port"] %\>\>  
...

HTTPS:  
\<VirtualHost _default_:\<%= node["php\_app"]["https\_port"] %\>\>

Might be a better way to do this, but this seems to work.

--  
Ryan Walker

On Mar 14, 2013, at 12:55 PM, Phil Mocek [phil-lists@mocek.org](mailto:phil-lists@mocek.org)  
wrote:

> What is the preferred method of configuring a Web application  
> deployed via the [application\_php cookbook](http://community.opscode.com/cookbooks/application_php) to accept HTTP over  
> SSL connections on port 443 and to redirect requests on 80 to 443?
> 
> I'm using application\_php with success, but it is [hard-coded to  
> cause the http server to listen on 8080](https://github.com/opscode-cookbooks/application_php/blob/master/templates/default/php.conf.erb#L1). I don't find any  
> discussion of SSL or of alternative ports in documentation of the  
> application\_php and application cookbooks or of the deploy  
> provider. The apache2 cookbook docs show how to install mod\_ssl  
> and to specify some cipher configuration, but as far as I can  
> tell, none of that matters as long as application\_php is  
> configuring Apache to do name-based virtual hosting on 8080. Web  
> searches for relevant keywords have turned up nothing relevant.
> 
> References:
> 
> --  
> Phil Mocek  
> [http://mocek.org/](http://mocek.org/)