0

One of my users is having some trouble with forwarding to an internal web app from a public address.

Everything worked fine for him when the situation was like this:

This is to say, my user is providing the very last URL, with the port information duplicated in the URL base, and they were using that to give a public face that hid both the port and the internal machine name. You could still read the port in the URL base if you looked, but the obvious reference and machine name were hidden.

Doing it this way, he could have several different instances of the application running on secret.example.com with different ports, and on the front end it just looked like it was changing the URL directory/base.

Now the user wants to do the same thing over https:, and the people helping him with apache config say it can't be done.

Is that so? Without being there to tinker with the configuration myself, I'm not sure what his IT people have tried, but reading through the apache2 SSL FAQ and other docs, it seems like it should be possible to rewrite URLs to different ports and still use https:.

Improve this question

1 Answer 1

Reset to default
0

The SSL must be enabled only in the front end (public server), proxying a SSL request is the same of breaking the SSL security (man in the middle attack). So you will have: https://www.myexample.com/app-8903/app.html but it secretely will serve plain http connections from https://secret.myexample.com:8903/app.html

Of course if his apps try to redirect the URL to something else without SSL, there will be problems.

Improve this answer
4
  • What if both pages are signed with the same SSL certificate? Will that be trusted in that case? Or are you saying that any proxying of https pages is bad? (I may be misinterpreting how to read "is the same of breaking" ...)
    – Michael H.
    Jul 22, 2010 at 21:54
  • Even so, if you put anything in the middle of a SSL tunnel it will break (it's designed to do so). There are some firewalls that do that, but they have a complex mechanism for 'fooling' the clients, and even then they get warnings.
    – coredump
    Jul 23, 2010 at 3:06
  • So, if I understand correctly, you're saying that what we're trying to do can never work?
    – Michael H.
    Jul 27, 2010 at 6:32
  • If you want the https to be generated on the secret servers and be proxied to outside, no, it will not work. If you do client -> public server SSL, and public server -> secret server without https, it will work.
    – coredump
    Jul 27, 2010 at 20:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .