BigIP load balanced Rails 3 / Apache app not handling selective SSL correctly?

Question

So here's the setup. I've got a Rails 3 application deployed to two servers, both running Apache2, both with identical VirtualHost configs, both operating on Passenger. There are a few routes in the Rails application that require requests to be done on SSL, so I've defined those routes with :protocol => 'https as necessary.

These two servers are part of a load-balancing pool on our BigIP load balancer, with one profile setup to handle port 80 traffic, and another to handle port 443 traffic. We've purchased a cert and we've loaded it onto the BigIP box, as well as setup a profile for the cert that's assigned to the :443 profile.

My Apache configs on each server identically define ServerName, DocumentRoot, SetEnv (for my Rails environment), and all that jazz inside a <VirtualHost *:80 *:443> declaration (note that in mucking with these files, removing the *:443 bit changed absolutely nothing). There's nothing really out of the ordinary there.

When browsing to this site on port 80, traffic passes through just fine and it hits the Rails application. When browsing to the login page, which requires HTTPS, the browser will just sit there and try to contact the page. Eventually my browser gives me a server unexpectedly dropped the connection error.

My question is this: how does BigIP send SSL traffic to the servers in its pool, and how is Apache supposed to recognize that? I don't even get entries in my Apache logs that the traffic even hits the two backend servers. Is there something I need to modify with a Passenger configuration somewhere to allow this traffic?

If there's more info needed than what I've posted already, let me know and I'll append it to this question. It appears I'm greener at this kind of stuff than I thought!

Also; since I feel really kinda dumb about this stuff, what's a great resource to help me learn about how web servers handle SSL requests?

Answer 1

If you've loaded the certs on the F5 LTM and associated them with the virtual server listening on port 443 then the the F5 terminates the SSL and passes the HTTP traffic to the pool. Apache won't see SSL traffic, just the "http" part of https. You can use the same pool as the port 80 traffic.

It sounds like either your cert isn't loaded properly in the F5 or the ssl profile is not associated with your 443 Virtual Server.

Answer 2

My answer is similar to ERR0's...

If you have private VLANs then it's really not necessary for your HTTP server to listen on 443. Rather your application should be reverse proxy aware and redirect certain pages e.g. /login to a SSL/HTTPS version of the page.

Read up on the X-Forwarded-For and X-Forwarded-Proto HTTP Headers.

I'm not familiar with Rails but perhaps there is a module that does this for you? i.e. Allows you to specify which pages should redirect to a SSL/HTTPS version.

Cheers