3

I have a service running in google cloud, basically several machines behind google http(s) load balancer. I've setup two balancing rules, one for http:// and one for https://. The thing I want to do is to redirect all http:// requests to https://. There is an apache running on each node so I make configuration like:

<VirtualHost *:80>
    ServerName my.app.com

    Redirect permanent / https://my.app.com
</VirtualHost>


<VirtualHost *:443>
    ServerName my.app.com
    SSLEngine On
    ....
</VirtualHost>

This should make apache to return 301 in case of somebody is accessing plain http. This worked fine till I moved behind the google http load balancer since then I am getting 400 and:

Bad Request

Your browser sent a request that this server could not understand. Reason: You're speaking plain HTTP to an SSL-enabled server port. Instead use the HTTPS scheme to access this URL, please.

Apache/2.4.10 (Debian) Server at my.app.com Port 443

It looks like google load balancer consumes the 301 and redirects the plain http request to https endpoint instead of forwarding the 301 to the client. I have not found any settings regarding 3XX forwarding in the google load balancer settings. Has anyone made this kind of setup working?

3
  • I am not sure it would work. The idea behind https is that it establishes a secure connection between the browser (user) and the server. I think you should send it back to the client to tell them to switch to a different protocol.
    – Grzenio
    Nov 4, 2015 at 12:31
  • Yeah, thats what I am trying to achieve - make the load balancer forwarding all redirects to the client instead of forwarding the original http request to the https endpoint. But I don't know how to do it...:) Nov 4, 2015 at 14:24
  • 1
    The client connections over port 80 and port 443 are to the ForwardingRules. The load balancer then creates connections to Apache on your VMs based on how you've configured your BackendService. So your VMs will only see traffic on port 80 or on port 443; not both. The load balancing layer will set X-Forwarded-Proto to 'http' or 'https', which you can use to send your 301. Possibly you have a different setup, but HTH.
    – Matt S.
    Nov 17, 2015 at 23:39

1 Answer 1

4

Ok, I will answer myself, maybe someone find this useful later.

Currently it is not possible to achieve forwarding of 301 using Google HTTP Load balancing to client. Load balancer will see the 301 and will send your plain HTTP request to the adress where 301 points - which is the same server, but port 443. Your server expects HTTPS packet but HTTP arrives so it fails.

Solution which is currently working for us - use Haproxy or Nginx as reverse proxy instead of Google HTTP Load Balancer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.