10

I need a MediaWiki installation to require the use of https (and reject normal http). I've spent 2 hours looking. Setting $wgServer doesn't work and closing port 80 in httpd.conf doesn't work either.

My wiki installation is run on an Apache server.

2
  • 1
    Telling Apache not to listen on port 80 will work, if you do it correctly. Commented Jun 12, 2012 at 13:29
  • Also, what operating system are you running? Commented Jun 12, 2012 at 13:31

4 Answers 4

8

I've just done this on Ubuntu 14 (for the first time today, so there may be a better way!) by setting

$wgServer = "//myhostname.com/mediawiki";

This makes the server name "protocol relative" so it works with either HTTP or HTTPS. You can probably just set it to https://... though.

Then configure apache2 to redirect all HTTP traffic to HTTPS:

Edit the default SSL configuration (this assumes you are just using the default site):

sudo vim /etc/apache2/sites-available/default-ssl.conf

to read something like:

# Redirect HTTP to HTTPS
<VirtualHost *:80>
     ServerAdmin [email protected]
     ServerName example.com

     Redirect permanent / https://example.com/
</VirtualHost>

# Normal HTTPS config for default site
<VirtualHost *:443>
     SSLEngine On
     SSLCertificateFile /etc/apache2/ssl/apache.pem
     SSLCertificateKeyFile /etc/apache2/ssl/apache.key

     ServerAdmin [email protected]
     ServerName example.com
     DocumentRoot /var/www/html/
     ErrorLog ${APACHE_LOG_DIR}/error.log
     CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Enable the default SSL site, if you haven't already (this creates a link from sites-enabled to sites-available)

sudo a2ensite default-ssl

This assumes that you have already obtained an SSL certificate (I generated a self-signed one) which has been placed in /etc/apache2/ssl/apache.pem and /etc/apache2/ssl/apache.key as referenced in the config above.

Finally get apache to use the new config:

sudo service apache2 restart

(Or reload may be enough)

2
  • How would this answer change if we wanted example.com directed to www.example.com; and then make everything HTTPS? (I tried to setup the same configuration from similar Questions and Answers. I thought it was correct, but MediaWiki logins are broken (everthing else is OK). Now I am here trying to "enable HTTPS for Mediawiki by default").
    – jww
    Commented Nov 6, 2016 at 1:36
  • i wonder why this "protocol-relative" syntax is not the default! thanks for saving me today :)
    – lensovet
    Commented Nov 7, 2016 at 7:21
7

My answer assumes that you already have Apache listening for https traffic on port 443. If that's not the case, you need to set that up first. The procedure will be different depending on what operating system you are running.


You want to do this in Apache. On my Ubuntu system, there's a file /etc/apache2/ports.conf which contains the following line:

Listen 80

You will have a similar config file that contains that line. Delete it, and don't forget to restart Apache.


Another way to accomplish this, which allows for more complex Apache configurations where you allow HTTP access to some parts of the site, is to use a .htaccess file in your MediaWiki directory. Try this:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
3
  • Does this ensure that the wiki will not set the login/search form to post to http? Commented Sep 4, 2015 at 10:47
  • 1
    > Another way to accomplish this ... // This is what worked for me perfectly.
    – kghbln
    Commented Dec 3, 2018 at 8:49
  • 7 years later... a redirect (RewriteRule) is definitely the better way to do this. Disabling port 80 is not a good idea because you want people to be able to type in the domain name without https://. Commented Jul 17, 2019 at 4:00
1

Given that your web server is set up to support https in general, insert or update the following line in your LocalSettings.php configuration file of MediaWiki:

$wgForceHTTPS = true;

This redirects all queries using http to https and is an alternative to a redirect rule in the web-server configuration.

See also:

1
  • I think this is the best answer. Also, make sure to set $wgServer to use "https://". If $wgServer starts with "http://", an exception will be thrown. Commented Dec 8, 2021 at 18:55
0

I added this block of code to my LocalSettings.php

if($_SERVER["HTTPS"]!="on") 
{
  $newurl="https://".$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
  header("Location: $newurl");
  exit();
}

Does exactly what you're asking.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.