Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wish to set up a new website that will be accessed by users using HTTPS. I think it is good practise to put the "real" web server in a seperate subnet, and then install an Apache Reverse Proxy in a DMZ.

My question is, where should I put the SSL cert(s)? Should I

a) Use a self-signed cert on the "real" web server, and a proper cert on the reverse proxy?

b) Use 2 real certs on both the "real" web server and the reverse proxy?

c) Don't use any cert on the "real" web server, and use a proper cert on the reverse proxy?

I'd like to use a) or c), if possible. I also don't want anyone's browser complaining of a self-signed cert.


share|improve this question

have look this link ssl

share|improve this answer
Thanks, but I already know how to set up a standalone SSL Apache server. What I'm asking is the layout of the infrastructure, and where to encrypt connections – jtnire Aug 3 '10 at 15:55
host-to-host IPsec connection – Rajat Aug 4 '10 at 16:35

Typically, Web servers would go in the DMZ unless for an unusual reason they contain restricted or confidential information. Databases typically contain that data, which go in a more restricted subnet.

Often, modern DMZs are an internally reserved subnet. You would have a firewall on the edge network, which would provide NATing to that subnet. What I describe is a dual firewall configuration.

SSL certificates would be acceptable on the network segment where the Web servers live. I typically lean towards encryption whenever reasonably possible unless there's another consideration at the time. I would use a CA signed SSL certificate in all cases that you describe.

share|improve this answer
So what should I do? Forego the Apache reverse proxy and just have a single Apache SSL web server in my DMZ, and put my DB server in a seperate subnet, and only allow the MYSQL port from webserver to DB server subnet? – jtnire Aug 3 '10 at 15:54
I'd recommend that over your existing proposal. You could still use the reverse proxy but the main benefits would be caching and abstracting, which enables URL re-writing. Potentially load balancing depending on the proxy but I consider that outside of the reverse proxy role. – Warner Aug 3 '10 at 16:02
Warner, can you please explain the benefit of placing the DB in a seperate subnet? As if the DMZ Webserver was compramised, woudn't the MYSQL credentials be available to the attacker? Thanks – jtnire Aug 3 '10 at 16:04
Also, a benefit of using a reverse proxy would be so that I could install ModSecurity (WAF). My current train of though is to put reverse proxy in the DMZ, and to put the "real" webserver and DB server in a sepereate subnet. However, since this whole setup will be on Xen, I can use iptable to filter between webserver and db server, even though they are on same subnet. How does that sound? – jtnire Aug 3 '10 at 16:11
Separating the db reduces the footprint, as you can substantially lessen accessibility. It is an additional step that would be necessary for a complete compromise. – Warner Aug 3 '10 at 19:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.