Configure HTTP Strict Transport Security (HSTS) with Apache

Ubuntu Linux

This brief tutorial shows students and new users how to configure HTTP Strict Transport Security (HSTS) with Apache on Ubuntu Linux.

If you’re using HTTPS or going to be using it on your websites, then HSTS is something you might want to configure as well.

HTTP Strict Transport Security (HSTS) is a security policy that help protect against downgrade attacks and cookies hijacking. When configured, your web server enforces strict HTTPS connection for web browsers and never via the insecure HTTP protocol.

To enhance connections to your Apache web server make sure that HSTS is also enabled to help protect against man-in-the-middle attack.

Since newer web browsers are all HSTS enabled, this should work across most systems. When a web browser contacts a HSTS enabled server, the browser by default looks for a special HTTP header related to HSTS.

If the special header is enabled, the web server instructs the browser to only communicate over HTTPS.  When the web browser receives the instruction from the header, the next connection after that will always be HTTPS and never HTTP.

This always insures that the connection between the web server and web browser is also protected.

How to enable Apache headers module

To use HSTS with Apache, you’ll want to enable Apache headers module. To do that, run the command below:

sudo a2enmod headers

How to enabling HSTS with Apache

After enabling the headers module for Apache, look at the VirtualHost file for your website and add the line below.

The line should be placed between the <VirtualHost *:443> and </VirtualHost>

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

An example VirtualHost file with HSTS enabled should look similar to the one below.

<VirtualHost *:443>
       # The ServerName directive sets the request scheme, hostname and port
       # the server uses to identify itself. This is used when creating
       # redirection URLs. In the context of virtual hosts, the ServerName
       # specifies what hostname must appear in the request's Host: header to
       # match this virtual host. For the default virtual host (this file) this
       # value is not decisive as it is used as a last resort host regardless.
       # However, you must set it for any further virtual host explicitly.

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

</VirtualHost>

Because you enabled HTST in Apache, you’ll also want to redirect all connections over HTTPS. To do that, open Apache default SSL configuration file.

The default SSL file on Ubuntu system is at /etc/apache2/sites-enabled/000-default-ssl.conf

Redirect all traffic on HTTP to HTTPS. This is a must if you want HSTS to function correctly with Apache.

Open Apache default SSL configuration file, then add the block of code in that config file and save.

sudo nano /etc/apache2/sites-enabled/000-default-ssl.conf

Add the highlighted lines and save.

<VirtulHost *:80>  
.....  
       RewriteEngine on
       RewriteCond %{SERVER_NAME} =www.example.com [OR]
       RewriteCond %{SERVER_NAME} =example.com
       RewriteRule ^  [END,QSA,R=permanent]
.....

 </VirtualHost>

Once you’re done, restart Apache.

sudo systemctl restart apache2

That should do it!

Conclusion:

This post showed you how to enable HSTS with Apache in Ubuntu. If you find any error above or have something to add, please use the comment form below.

Tags:

You may also like...