PHP Grumph.

[swestrup]

Well, it turns out my PHP problems had nothing to do with PHP. What was happening was that the php scripts were (for reasons I've yet to figure out) asking for my http connection to the script pages to be converted to an https connection. I haven't set up https, so I kept getting 'Connection Refused' errors. It wasn't until I tried using lynx that I got a trace of what went wrong that was usable to diagnose the problem.

Now I just gotta figure out why that was happening.

Comments

[sps.livejournal.com]

Because they don't want to see passwords shipped in the clear. I'm inclined to think this problem may not want fixing....

[swestrup]

I'm inclined to agree, but I want to do this incrementally, so its easier to debug. Squirrelmail's docs make no mention of https, and it doesn't even show up as an option in the config file. I just found out that one of the plugin's which is called 'enhance security' and comes with no docs was the culprit. I had activated it just because it sounded good...

I would have set up https ages ago, but https supports only ONE domain per IP, and we're currently hosting something like 10. So, who gets the https?
(I keep thinking there has to be a way to provide https to all the domains, but so far everything I've explored has come to naught.)

[sps.livejournal.com]

secure.pooq.com? I dunno. I doubt we will have many https pages, or will we?

I agree it is lamemost if https can't vhost... I mean, it's the dynamic content that has security properties, right?

[swestrup]

I think I've figured out how to get things working for all the domains.

I'll try to configure the one https virtual host that I am allowed, so that it reverse proxies all connections to the other virtual hosts.

That way all https traffic between the webserver and the internet will be encrypted, but will have to go over an extra internal unencrypted hop. The only problem is that the final virtual host may have no way of knowing if encryption has been correctly set up for it, or not, but I think that problem can be worked around. In the worst case, I'll run a second copy of apache, which will listen on the loopback interface and we can give each host its own loopback IP number, but I don't think it will come to that.

[sps.livejournal.com]

You are well insane ;).