1

The TLS handshake initiation contains the requested domain in cleartext, to allow a server to select the correct certificate. Therefore, the server should be able to proxy the handshake, and all subsequent packets, to the correct domain/machine/server, without performing the authentication. Therefore, it should not need any certificates to perform this proxying. This would come in handy when there are a couple of servers in the local network, each serving one domain.

My question is: is it possible to configure apache(2) to proxy incoming requests, over a HTTPS connection to the correct domains, without it having access to the certificates for said domains?

  • 1
    Apache can only do proxying at the HTTP level which isn't sufficient for what you want to do. But nginx and haproxy can proxy at the TCP level based on the name in the TLS handshake (SNI) which is what you want. – Steffen Ullrich Dec 25 '18 at 12:38
  • Please turn this into an answer so I can upvote it and mark it as "the answer" ;-) – Tempestas Ludi Dec 25 '18 at 12:41
  • "The TLS handshake initiation contains the requested domain in cleartext, to allow a server to select the correct certificate." This is SNI, but works is underway to have encrypted SNI, at which point there will be nothing visible in the TLS handshake that will provide information on which website is requested. – Patrick Mevzek Dec 27 '18 at 14:56
  • @PatrickMevzek What I mainly meant, is that some part of the server software must know which domain is requested, in order to select the correct certificate. Therefore, it should be able to know which domain is requested and to which domain/machine it should proxy. – Tempestas Ludi Dec 27 '18 at 15:03
  • 1
    Not sure to understand your question and indeed should be posted separately if needed. I do not know where your "no certificates are used in the SNI encryption" comes from. The technical specification for that encrypted SNI is at tools.ietf.org/html/draft-ietf-tls-esni or look at blog.cloudflare.com/encrypted-sni for a gentler introduction on the subject. – Patrick Mevzek Dec 27 '18 at 17:22
2

Apache can only do proxying at the HTTP level which isn't sufficient for what you want to do. What you want instead is proxying at the TCP level based on the name in the TLS handshake (SNI) - nginx and haproxy can do this, Apache not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.