Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have configured Apache on local server (Server1) and Apache Tomcat on remote server (Server2). Apache works with mod_jk connector that redirect requests to remote Tomcat. Both working on SSL. Is this configuration is safe and use encryption beetween Server1 and remote Server2 ?

share|improve this question
How remote is the tomcat instance? Is it another server in the same rack, another datacentre in the same company, or another datacentre at a different company? How are the networks between apache and tomcat connected? Is there a VPN link in-place, is it a private LAN / WAN, or do they communicate over the public internet without a VPN? – Mike Insch Jul 22 '11 at 12:11
They communicate over public internet, but both use https / SSL. – marioosh Jul 22 '11 at 12:42
On one server is Apache, on another is Tomcat. Both communicate over internet. Config is as in my previous question here – marioosh Jul 22 '11 at 13:11
I took a look at your setup from your previous question - you are aware that the connection between apache and tomcat is not encrypted? With your setup, only the connection from your user to your apache server is protected by SSL, the connection using mod_jk from apache to tomcat is open. If this channel also needs encryption then no, this is not safe. – Mike Insch Jul 22 '11 at 13:26
You may want to change to mod_proxy to do the HTTPS trick – ghm1014 Jul 22 '11 at 15:17

Let say you have your public server on:

And your private server on:

Your apache configuration should look like:

<VirtualHost *:443>
SSLEngine on
SSLProxyEngine on 
ProxyPass /
ProxyPassReverse /

#Common SSL configuration
DirectoryIndex index.php index.html index.htm index.shtml
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn  
SSLProtocol all -SSLv2
SSLCertificateFile /etc/ssl/startssl/ssl.crt
SSLCertificateKeyFile /etc/ssl/startssl/ssl.key
SSLCACertificateFile /etc/ssl/startssl/
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
<Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.