As you can see, this blog is accessible through SSL (https) encryption only. Normally this is not a huge problem but WordPress is a little bit clunky if it comes to a setup that also includes a reverse proxy.

The following text is a sum up some pages which can be found on the internet but often lacks information. This WordPress blog that you are currently reading is running on an Apache httpd on localhost. In front of it, there is a second Apache httpd which acts as reverse proxy for different tasks. One of these tasks is to offload SSL (https) encryption.

WordPress installation

In the described setup you should first install the WordPress software on http (port 80) without SSL. If you enable SSL at this time chances are good that you end up in a redirect loop.

Configure SSL (https)

On the reverse proxy configure SSL as usual but be aware, that you have to set RequestHeader set X-Forwarded-Proto "https" inside the SSL virtual host! This information is important as otherwise the URL’s generated by WordPress will be http links and therefore you will get browser warnings later. Do not force a permanent redirect from http to https at this point or you will not be able to install the necessary WordPress plugin which take care on your URL’s.

After you have enabled basic https support install the WordPress extension SSL Insecure Content Fixer and configure it to use the X-Forwarded-Proto header. Afterwards you have to modify the wp-config.php to reflect this settings. If you want use Jetpack, you also have to specify SERVER_PORT otherwise you will receive a error message on wordpress.com during the configuration of your social media connections (There was an error retrieving your site settings.). You also have to force admin SSL usage.

Hopefully this will help some people out there to get this up and running. If this config does not help you, leave a comment!

Apache http reverse proxy config

# ************************************
# Vhost template in module puppetlabs-apache
# Managed by Puppet
# ************************************

<VirtualHost *:443>
 ServerName www.wittedeurbellen.nl
 ServerAdmin webmaster@wittedeurbellen.nl

 ## Vhost docroot
 DocumentRoot "/var/www/html/www.wittedeurbellen.nl"

 ## Directories, there should at least be a declaration for /var/www/html/www.wittedeurbellen.nl

 <Location "/">
 Options None
 Require all granted
 </Location>

 <Location "/wp-admin">
 Options None
 Require all granted
 </Location>

 ## Logging
 ErrorLog "|/usr/sbin/rotatelogs -l -f /var/log/httpd/external/www.wittedeurbellen.nl/error-ssl_log.%Y.%m.%d 86400"
 ServerSignature Off
 CustomLog "|/usr/sbin/rotatelogs -l -f /var/log/httpd/external/www.wittedeurbellen.nl/access-ssl_log.%Y.%m.%d 86400" combined

 ## Request header rules
 ## as per http://httpd.apache.org/docs/2.2/mod/mod_headers.html#requestheader
 RequestHeader set X-Forwarded-Proto "https"

 ## Proxy rules
 ProxyRequests Off
 ProxyPreserveHost On
 ProxyPass / http://blog.wittedeurbellen.lan/ timeout=120
 ProxyPassReverse / http://blog.wittedeurbellen.lan/

 ## Server aliases
 ServerAlias *.wittedeurbellen.nl

 ## SSL directives
 SSLEngine on
 SSLCertificateFile "xxxxx.pem"
 SSLCertificateKeyFile "xxxxx.pem"
 SSLCertificateChainFile "xxxxxchain.pem"
 SSLCACertificatePath "/etc/pki/tls/certs"
 SSLOptions +StdEnvVars +ExportCertData

 # SSL Proxy directives
 SSLProxyEngine On
</VirtualHost>

Nginx reverse proxy

I dont use Nginx at the moment, but it should work in the same manner. Just be shure that the X-Forwarded-Proto header is submitted by the reverse proxy to the backend.

WordPress wp-config.php

define('FORCE_SSL_ADMIN', true);
$_SERVER['SERVER_PORT'] = 443;