1

I have just installed an SSL certificate on my webserver which is working fine for multiple subdomains without any issue.

I then have a particular subdomain which receives a request through Apache and then it should be proxied through to a C++ application (which I've developed) running on localhost on port 6000. When using the proxy I get a certificate error, I know the C++ application is OK as if I connect apache on port 80 and proxy through its fine.

Below is the virtualhost config for the subdomain doing the proxying:

<VirtualHost *:443>
SSLEngine On
ServerName my-subdomain.example.com
SSLCertificateFile /etc/httpd/certs/mycert.crt
SSLCertificateKeyFile /etc/httpd/certs/mycert.key
ProxyPass / http://127.0.0.1:6000
ProxyPassReverse / http://127.0.0.1:6000
</VirtualHost>

When doing a request with curl I get the following:

curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

If I do the -k I then get the correct response but I don't really want to have to turn verification off.

No matter what I try nothing works but it is specific to the proxy, if I just serve a normal website then the certificate configuration is fine.

1

Figured I was missing the intermediate certificate. I'm not sure why this being missing only affected the reverse proxy and not serving a standard website though.

  • The end client may have had the intermediary installed locally, where the webserver host may not have had them, hence the refusal. – Patrick Mevzek Aug 30 '18 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.