3

I'm trying to set up an Apache server that uses ProxyPass to pass HTTPS requests on to another server.

Let's call the proxy server ALPHA and the target server BETA.

ALPHA does not run HTTPS, but BETA does.

I first tried using this virtual host specification on ALPHA:

<VirtualHost *:443>
  ServerName mysite.com
  ProxyPass / https://192.168.1.105/   # BETA's IP address
  ProxyPassReverse / https://192.168.1.105/  # BETA's IP address
  ProxyPreserveHost On
  ProxyTimeout 600

  SSLProxyEngine On
  RequestHeader set Front-End-Https "On"
  CacheDisable *
</VirtualHost>

But when I tried this, Apache complained saying, "[error] Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile]".

I had to copy the SSL certificate from BETA to ALPHA and add these lines to the virtual host specification on ALPHA:

  SSLEngine on
  SSLCertificateKeyFile /usr/local/ssl/private/BETA_private.key
  SSLCertificateFile /usr/local/ssl/crt/BETA_public.crt
  SSLCertificateChainFile /usr/local/ssl/crt/BETA_intermediate.crt

Now the system works. But I have a feeling that I have done something wrong or unnecessary. I have the web site's private key and certificate lying on both ALPHA and BETA. Is that necessary? Should I have done it differently?

2
  • Looks like you are encrypting the traffic twice. Normally the SSL terminates at the reverse proxy as it is unnecessary to encrypt the traffic over a secure LAN connection. Aug 24, 2014 at 17:09
  • Of course. I didn't think about it that way. Thank you, @QuestionOverflow. If you will turn your comment into a proper answer, I will acknowledge it as the answer and (when I may) award you the bounty.
    – oz1cz
    Aug 25, 2014 at 7:56

1 Answer 1

1
+50

Looks like you are encrypting the traffic twice - once over WAN and another time over LAN. Normally, the reverse proxy would be set up as the SSL termination point as it is usually unnecessary to encrypt the traffic over a secure LAN connection.

From your Apache configuration, the reverse proxy (Server ALPHA) is connecting to the web server (Server BETA) via a private IP address (192.168.1.105). I would assume that the reverse proxy is accessed by a hostname found in the SSL certificate.

For SSL to work properly for users connecting over WAN, the cert, key and keychain would need to be installed on the reverse proxy (Server ALPHA). As for the web server (Server BETA), if your users are not connecting directly to it, there is no need to install a valid SSL cert.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.