Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of my users is having some trouble with forwarding to an internal web app from a public address.

Everything worked fine for him when the situation was like this:

This is to say, my user is providing the very last URL, with the port information duplicated in the URL base, and they were using that to give a public face that hid both the port and the internal machine name. You could still read the port in the URL base if you looked, but the obvious reference and machine name were hidden.

Doing it this way, he could have several different instances of the application running on secret.example.com with different ports, and on the front end it just looked like it was changing the URL directory/base.

Now the user wants to do the same thing over https:, and the people helping him with apache config say it can't be done.

Is that so? Without being there to tinker with the configuration myself, I'm not sure what his IT people have tried, but reading through the apache2 SSL FAQ and other docs, it seems like it should be possible to rewrite URLs to different ports and still use https:.

share|improve this question

1 Answer 1

The SSL must be enabled only in the front end (public server), proxying a SSL request is the same of breaking the SSL security (man in the middle attack). So you will have: https://www.myexample.com/app-8903/app.html but it secretely will serve plain http connections from https://secret.myexample.com:8903/app.html

Of course if his apps try to redirect the URL to something else without SSL, there will be problems.

share|improve this answer
    
What if both pages are signed with the same SSL certificate? Will that be trusted in that case? Or are you saying that any proxying of https pages is bad? (I may be misinterpreting how to read "is the same of breaking" ...) –  khedron Jul 22 '10 at 21:54
    
Even so, if you put anything in the middle of a SSL tunnel it will break (it's designed to do so). There are some firewalls that do that, but they have a complex mechanism for 'fooling' the clients, and even then they get warnings. –  coredump Jul 23 '10 at 3:06
    
So, if I understand correctly, you're saying that what we're trying to do can never work? –  khedron Jul 27 '10 at 6:32
    
If you want the https to be generated on the secret servers and be proxied to outside, no, it will not work. If you do client -> public server SSL, and public server -> secret server without https, it will work. –  coredump Jul 27 '10 at 20:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.