Merge branch 'ubilabs--rcapp--master' into ubilabs--rcapp--develop

home.md

@@ -1,6 +1,6 @@
 # Welcome to the SAP Sailing Wiki
 
-This is the <img src="http://www.sapsailing.com/images/sap-logo_grey.png"/> Wiki where useful information regarding this project can be found.
+This is the <img src="https://www.sapsailing.com/images/sap-logo_grey.png"/> Wiki where useful information regarding this project can be found.
 
 ### The Pitch
 

wiki/ssl-support.md

@@ -1,6 +1,6 @@
 # Supporting HTTPS / SSL
 
-On sapsailing.com, we have a security certificate installed. For root users its key is visible at `/etc/pki/tls/private/star_sapsailing_com.key`. The certicicate is at `/etc/pki/tls/certs/star_sapsailing_com.crt`. To enable SSL on a server, the module `mod_ssl` needs to be installed. Use ``yum install mod_ssl``.
+On sapsailing.com, we have a security certificate installed. For root users its key is visible at `/etc/pki/tls/private/star_sapsailing_com.key`. The certicicate is at `/etc/pki/tls/certs/star_sapsailing_com.crt`. The intermediate CA file from [https://knowledge.symantec.com/support/ssl-certificates-support/index?page=content&actp=CROSSLINK&id=INFO2045](https://knowledge.symantec.com/support/ssl-certificates-support/index?page=content&actp=CROSSLINK&id=INFO2045) is at `/etc/pki/tls/certs/server-chain.crt`. To enable SSL on a server, the module `mod_ssl` needs to be installed. Use ``yum install mod_ssl``.
 
 The `/etc/httpd/conf/httpd.conf` file must contain the following in order to ensure that the `ServerName` setting is respected for selecting the appropriate `VirtualHost` element:
 
@@ -15,26 +15,33 @@ When this is done, the server can use the following sequence of directives insid
         SSLEngine  On
         SSLCertificateFile /etc/pki/tls/certs/star_sapsailing_com.crt
         SSLCertificateKeyFile /etc/pki/tls/private/star_sapsailing_com.key
+        SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
 </pre>
 
+We have this also in a macro called SSL that is defined in `/etc/httpd/conf.d/000-macros.conf` like this:
+
+```
+<Macro SSL>
+        SSLEngine  On
+        SSLCertificateFile /etc/pki/tls/certs/star_sapsailing_com.crt
+        SSLCertificateKeyFile /etc/pki/tls/private/star_sapsailing_com.key
+        SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
+</Macro>
+```
+
+It can then simply be used in any `VirtualHost` definition using `Use SSL`.
+
 A full-blown &lt;VirtualHost&gt; element in a rewrite macro in `000-macros.conf` then could look like this:
 
 ```
 <Macro Event-SSL $HOSTNAME $EVENTUUID $IP $PORT>
     <VirtualHost *:443>
         ServerName $HOSTNAME
-
-        SSLEngine  On
-        SSLCertificateFile /etc/pki/tls/certs/star_sapsailing_com.crt
-        SSLCertificateKeyFile /etc/pki/tls/private/star_sapsailing_com.key
-
+        Use SSL
         Use Headers
-
         RewriteEngine on
-
         RewriteCond %{REQUEST_URI} "^(/)?$"
         RewriteRule ^(/)?$ "https://$HOSTNAME/gwt/Home.html?%{QUERY_STRING}#/event/:eventId=$EVENTUUID" [L,NE]
-
         Use Rewrite $IP $PORT
     </VirtualHost>
 </Macro>
@@ -46,4 +53,13 @@ It can then be used inside the `001-events.conf` file like this
 Use Event-SSL ssltest.sapsailing.com "f8087b3c-c641-4fda-bf8d-0bc2abe09e40" 172.31.22.239 8888
 ```
 
-Keep in mind that the certificate we have only is valid for `*.sapsailing.com` which does not include 2nd-level sub-domains such as a.b.sapsailing.com.
+Keep in mind that the certificate we have only is valid for `*.sapsailing.com` which does not include 2nd-level sub-domains such as a.b.sapsailing.com.
+
+To have a non-SSL `VirtualHost` redirect to the SSL counterpart, use a definition like this:
+
+```
+<VirtualHost *:80>
+        ServerName jobs.sapsailing.com
+        RedirectPermanent / https://jobs.sapsailing.com/
+</VirtualHost>
+```