This makes me really a headache!
At first a schema that explains the matter much more efficient:
------WWW / Internet--||-------------Intranet---------------
+----------+ +----------+ HTTP +----------+
| | | SSL | ---------> | Web 3. |
| Client | 1. | reverse | 2. | App |
| | ---------> | Proxy | | Server |
+----------+ HTTPS +----------+ +----------+
- The client requests the reverse proxy over SSL.
- The reverse proxy does the protocol switch to http and forwards the request packet (ProxyPreserveHost is on)
- The application server generates static links out of the request header "host" variable. With all the goodies FQDN and protocol (http://FQDN.tld:80/etc) :-( You know what the App Server answers when I fiddle with the header host variable... (Bad Request)
- After that the reverse proxy sends the response to the client over SSL.
- Naturally the clients requests all the linked images and stylesheets over http. This requests ask the reverse proxy and falls on deaf ears.
Solutions which are not welcome:
- SSL inside the intranet (security, performance and less debugging options)
- Appserver is not modifiable (not discussible)
- mod_proxy_html (performance, the DOM parser destroys many JS's)
- no http traffic is allowed in the Internet zone (security)
Everything works, only the protocol switching makes trouble with the static links. Redirects get managed with ProxyPassReverse, but this doesn't effect the static links.
How can I manage that the static links go over https?
It would be enough if the protocol and the appended port number could be removed!
Did anyone need more information I will provide it here:
Proxy is apache 2.2.17!
AppServer is jboss with tomcat 5.5!
Many thanks Hendrik