Configuring HSTS with Apache on Ubuntu: A Step-by-Step Guide

This brief tutorial shows students and new users how to configure HTTP Strict Transport Security (HSTS) with Apache on Ubuntu Linux.

If you’re using HTTPS or going to use it on your websites, then HSTS is something you might want to configure.

HTTP Strict Transport Security (HSTS) is a security policy that helps protect against downgrade attacks and cookies hijacking. When configured, your web server enforces strict HTTPS connection for web browsers and never via the insecure HTTP protocol.

To enhance connections to your Apache web server, ensure that HSTS is also enabled to help protect against a man-in-the-middle attack.

This should work across most systems since newer web browsers enable HSTS. When a web browser contacts an HSTS-enabled server, the browser, by default, looks for a special HTTP header related to HSTS.

If the special header is enabled, the web server instructs the browser to only communicate over HTTPS. When the web browser receives the instruction from the header, the following connection after that will always be HTTPS and never HTTP.

This ensures the connection between the web server and the web browser is protected.

How to enable the Apache headers module

To use HSTS with Apache, you’ll want to enable the Apache headers module. To do that, run the command below:

sudo a2enmod headers

How to enable HSTS with Apache

After enabling the headers module for Apache, look at the VirtualHost file for your website and add the line below.

The line should be placed between the <VirtualHost *:443> and </VirtualHost>

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

An example VirtualHost file with HSTS enabled should look similar to the one below.

<VirtualHost *:443>
       # The ServerName directive sets the request scheme, hostname and port
       # the server uses to identify itself. This is used when creating
       # redirection URLs. In the context of virtual hosts, the ServerName
       # specifies what hostname must appear in the request's Host: header to
       # match this virtual host. For the default virtual host (this file) this
       # value is not decisive as it is used as a last resort host regardless.
       # However, you must set it for any further virtual host explicitly.

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

</VirtualHost>

Because you enabled HTST in Apache, you’ll also want to redirect all connections over HTTPS. To do that, open the Apache default SSL configuration file.

The default SSL file on the Ubuntu system is at /etc/apache2/sites-enabled/000-default-ssl.conf

Redirect all traffic on HTTP to HTTPS. This is a must if you want HSTS to function correctly with Apache.

Open the Apache default SSL configuration file, add the code block in that config file, and save.

sudo nano /etc/apache2/sites-enabled/000-default-ssl.conf

Add the highlighted lines and save.

<VirtulHost *:80>  
.....  
       RewriteEngine on
       RewriteCond %{SERVER_NAME} =www.example.com [OR]
       RewriteCond %{SERVER_NAME} =example.com
       RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]
.....

 </VirtualHost>

Once you’re done, restart Apache.

sudo systemctl restart apache2

That should do it!

Conclusion

This post demonstrated how to enable HSTS with Apache on Ubuntu. Key takeaways include:

• HSTS enhances security by enforcing HTTPS connections and preventing downgrade attacks.
• Enabling the Apache headers module is a prerequisite for configuring HSTS.
• The Strict-Transport-Security header must be added to your VirtualHost file.
• It’s essential to redirect all HTTP traffic to HTTPS for HSTS to function properly.
• Restart the Apache server to apply the changes and ensure HSTS is active.