Steps

Once Apache forwards requests to XWiki on port 80, a second VirtualHost on port 443 serves the same wiki over HTTPS and the port 80 one redirects to it. This procedure continues Configure Apache HTTP Server as a Proxy on a Linux OS, and the directives it adds are described in Apache Server Key Configurations.

1. Obtain a TLS certificate and its private key for the wiki's domain.
2. Enable the modules the configuration below needs: sudo a2enmod ssl headers rewrite.
3. Add the HTTPS block to /etc/apache2/sites-available/xwiki.conf, carrying every proxy directive of the port 80 block:

   <VirtualHost *:443>
     ServerName wiki.example.com
   
     SSLEngine on
     SSLCertificateFile /path/to/certificate
     SSLCertificateKeyFile /path/to/privatekey
   
     ErrorLog ${APACHE_LOG_DIR}/xwiki-error.log
     CustomLog ${APACHE_LOG_DIR}/xwiki-access.log combined
   
     RedirectMatch ^/$ /xwiki/
   
     <Location /xwiki>
       Require all granted
     </Location>
   
     AllowEncodedSlashes NoDecode
   
     RequestHeader unset Forwarded
     RequestHeader unset X-Forwarded-Host
     RequestHeader unset X-Forwarded-Proto
     RequestHeader set X-Forwarded-Proto "https"
   
     ProxyRequests Off
     ProxyPreserveHost On
   
     ProxyPass /xwiki http://localhost:8080/xwiki nocanon upgrade=websocket
     ProxyPassReverse /xwiki http://localhost:8080/xwiki
   </VirtualHost>

4. Replace the body of the port 80 block in the same file with a redirect to HTTPS:

   <VirtualHost *:80>
     ServerName wiki.example.com
   
     AllowEncodedSlashes NoDecode
   
     RewriteEngine On
     RewriteCond %{REQUEST_URI} !^/\.well-known
     RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L,NE]
   </VirtualHost>

5. Set xwiki.home in the xwiki.cfg configuration file to the public base address, scheme and trailing slash included and without the /xwiki path: xwiki.home=https://wiki.example.com/.
6. Recommended: make the Servlet Container trust the forwarded headers as well, following Configure Tomcat to Find Proxy Headers. The wiki's own links do not depend on it — XWiki reads the headers itself — but it is what makes the container's view of the request match, so that its access log holds the reader's address rather than the proxy's.
7. Check the configuration and reload Apache: sudo apachectl configtest then sudo systemctl reload apache2.
8. Open https://wiki.example.com in a browser. The browser reports the connection as secure, the plain HTTP address redirects to it, and the wiki's own links all use https://.

FAQ

Why is /.well-known left on plain HTTP?

That is where an ACME client such as certbot answers the challenge that issues and renews the certificate, so redirecting it would break every automatic renewal.

Why does the wiki still generate plain HTTP links after HTTPS works?

Either the header never arrives — mod_headers is not enabled, so RequestHeader set X-Forwarded-Proto does nothing — or xwiki.home and xwiki.url.protocol in the xwiki.cfg configuration file still name plain HTTP, which takes precedence over what the request says. XWiki reads the forwarded headers itself, so the Servlet Container is not what to check first.

How do I make browsers use HTTPS without going through the redirect first?

Add Header always set Strict-Transport-Security "max-age=63072000" to the port 443 block. Only do so once every part of the wiki is served over HTTPS, because a browser remembers the instruction for the whole max-age and will refuse plain HTTP until it expires.

Related

• Configure Apache HTTP Server as a Proxy on a Windows OS.
• Configure Tomcat to Find Proxy Headers.
• Apache SSL/TLS Encryption.
• Configuration.