Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My JBoss app server has mutual SSL authentication setup (We do some processing based on the client certificate).

I need to have a web server in front of JBoss. Which is the best apache module that can do an SSL passthrough to JBoss?

share|improve this question

migrated from stackoverflow.com Mar 3 '11 at 17:49

This question came from our site for professional and enthusiast programmers.

    
"I need to have a web server in front of JBoss." What do you think a web server would be able to do? It would not be able to decrypt the traffic between the client and JBoss server and so there is nothing it could do except perhaps serve as a glorified firewall. –  Mark Wagner Mar 3 '11 at 18:34
    
It can also serve static contents and url re-writing –  Yasser Mar 3 '11 at 19:17

2 Answers 2

up vote 2 down vote accepted

Unless you're after something incredibly trivial (forwarding all SSL traffic directly to JBoss without any handling by Apache at all, in which case you might as well use a TCP forwarder like rinetd), whatever it is you're trying to do is not possible.

In order for Apache to do anything with the SSL connection, it must negotiate the symmetric key with the client. Once Apache has done this, JBoss will not be able to decrypt the connection if apache "just" forwarded the resulting stream to JBoss. Normally, you'd forward the decrypted connection to the application. You might even be able to get apache to establish a new SSL connection from Apache to JBoss, but without the client's certificate, it would not have the authentication information JBoss is looking for.

Things to consider: could you make JBoss read the connection headers of a non-ssl connection to get this client information? Then you could use mod_rewrite to capture the information from the client certificate. (List of available variables) (actual (if old) example of combining mod_rewrite,mod_headers,and mod_proxy to pull this off)

If the issue is that you want to serve some content through a webserver rather than through JBoss, consider setting up a separate host, like https://static.example.com.

share|improve this answer
    
No direct experience with this, but it sounds like using SSLOptions +ExportCertData will hand a client certificate through an AJP connection, by virtue of AJP's ability to pass environment variables. Not sure if JBoss would pick that variable up and use it for auth, though. See here –  Shane Madden Mar 3 '11 at 19:08
    
@Shane you should make that a separate answer, it's probably easier to implement than the mod_rewrite hackery I came up with. –  DerfK Mar 3 '11 at 19:31
    
Fair enough, done. –  Shane Madden Mar 3 '11 at 19:44
    
Thanks. It works. My question should have been to know the transfer of client certificate rather than making SSL pass through. –  Yasser Mar 4 '11 at 16:47

This may be a wild goose chase, since I'm unsure of how well JBoss will handle this, but it sounds like using SSLOptions +ExportCertData will hand a client certificate through an AJP connection, by virtue of AJP's ability to pass environment variables.

This depends on your comfort level with having the data between the Apache and JBoss servers being unencrypted, as well as whether JBoss will recognize the cert in the passed environment variable. See here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.