Using SSL with MidCOM template

1. What this means in practise

Here is how to make the MidCOM template use SSL encryption for all authenticated requests like content editing.

1. Set your MidCOM host to answer requests on port 80 and 443

2. Set up Apache VirtualHosts for them using Datagard

3. Add to the SSL VirtualHost (port 443):

   RewriteEngine On
   RewriteCond %{REQUEST_URI} !^/midcom-admin.*
   RewriteCond %{REQUEST_URI} !^/midcom-static.*
   RewriteCond %{REQUEST_URI} !\.(gif|jpg|css|ico)$
   RewriteRule /(.*)$ http://your-site.com/$1
   

4. Add to the non-SSL VirtualHost (port 80):

   RewriteEngine On
   RewriteCond %{REQUEST_URI} ^/midcom-admin.*
   RewriteRule /(.*)$ https://your-site.com/$1
   

The Apache SSL HOWTO is also useful in setting up the SSL VirtualHost.

What this means in practise

All your regular site usage will be on port 80. If anyone requests SSL, they get redirected to the corresponding non-SSL page. When you access anything in /midcom-admin (the editing part of MidCOM template), you get redirected to the SSL version.

The bits about midcom-static and gif, jpg, etc. is to make those requests avoid redirection. They will "travel" the SSL pipe and the browser won't complain about parts of the page being secure and others not.