Friends Don’t Let Friends Use HTTP – Enforcing TLS End-to-End
Duration: ~10 minutes
Overview
Put TLS on OpenShift Routes, force HTTPS with redirects, and pick the right termination mode: edge, re-encrypt, or passthrough.
Expose an app over HTTP, add TLS edge termination with redirect to HTTPS, and validate the result while comparing re-encrypt and passthrough options.
Why it matters
Plain HTTP leaves credentials, cookies, and API bodies open on the wire. TLS protects them in transit and proves the server identity. Redirecting HTTP to HTTPS stops casual downgrade to cleartext and is a common audit requirement.
Your Mission
Plain HTTP is free surveillance for anyone on the path—credentials, cookies, API bodies. Force TLS with redirect so downgrade and sniff attempts bounce to HTTPS.
Prereq: project from 101-11 (101-11-r-rebuild) with webapp still running. If that project was renamed for TLS, adjust below.
Click each step only if you need a hint.
Locate the exposed Route (attack surface today)
oc project 101-11-r-rebuild
ROUTE=$(oc get route webapp -o jsonpath='{.spec.host}' 2>/dev/null)
echo $ROUTEBaseline the insecure cleartext path
Confirm HTTP works—this is what an attacker on-path can read today.
curl http://$ROUTEEnforce edge TLS + HTTP→HTTPS redirect
Close the plaintext door. Edge termination plus redirect makes cleartext a hop to HTTPS, not a usable channel.
oc delete route webapp
oc create route edge webapp --service=webapp --port=8080 --insecure-policy=RedirectVerify the defended HTTPS path
curl -k https://$ROUTECleanup
oc delete project 101-11-r-rebuild --wait=falseDebrief
You baselineed cleartext HTTP, then enforced edge TLS with redirect so the route stops casual downgrade to plaintext.
What breaks without this:
-
HTTP Routes → credential sniffing, cookie theft, and API tampering on the wire
-
No redirect → clients keep using insecure URLs by habit
Controls that matter: HTTPS by default on new Routes, HTTP→HTTPS redirect, choose edge / re-encrypt / passthrough for your trust model, and plan certificate rotation.
Quick facts: edge TLS is fine when the cluster internal path is trusted; re-encrypt or passthrough when you need end-to-end or app-owned certs. Redirect (and HSTS where appropriate) closes downgrade paths.
