cabennett85/gittest — Issue #756: https for www.experienceproject.com
Author: cabennett85
Created: 2012-03-02 00:14:22+00:00
State: open

there are 2 ways to do it

1. would be to just use nginx to get https requests, un-https it and pass it to our webservers as regular http.

advantages:

using nginx for https(fast, efficient and harder to DOS)
no need to install/run apache on the nginx box

disadvantages:

code must be smart enough to detect if a certain request, that comes as http to a webserver, was in fact https when it hit nginx. this information is passed in http header.

2. install and run an apache webserver, which servers just https on the same server that's running nginx.

advantages:

-we are effectively adding another webserver(which is now pretty idle just running nginx). that takes some load off the main 3 webservers.(as we can just put it to serve http traffic too, we might as well, it will need to have all the code checked out, etc)

-less coding involved, detecting whether or not the request is https is easy as apache sees it as such.

disadvantages:

as apache takes care of https, it can be DOSed more easily than nginx.

also, if akamai(or similar) is ever going to step into the picture, I would advise to consider running https not on www.experienceproject.com but some other subdomain, such as secure.experienceproject.com