Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have an internal server that requires x509-based authentication, but I've been requested to open it up with a basic user/password authentication.

I've been trying to setup a reverse proxy in apache that uses a trusted certificate to connect to the internal server, but I don't seem to be able to choose and use the certificate. The basic authentication works fine.

Going through all relates questions here and googling for some days, my bet is that i need to use some SSLProxy* directives, but none of what I tried has been successful so far.

BTW, I'm using a self-signed certificate for authenticating in the internal server.

So far my .conf file reads like this

<VirtualHost *:80>
    ServerName external.server

    SSLProxyEngine on
    UnknownSSLDirectives

    ProxyRequests Off
    ProxyPass        / https://internal.server/
    ProxypassReverse https://internal.server/ /

    <Location />
        AuthType Basic
        AuthName "Authenticated proxy"
        AuthUserFile /etc/httpd/passwd/passwords
        Require user USER
    </Location>

    <Proxy>
        Order Deny,Allow
        Allow from all
    </Proxy>

    RequestHeader unset Authorization

    ErrorLog "logs/proxy.error.log"
    CustomLog "logs/proxy.access.log" common
</VirtualHost>

I seem to be so close, but cannot penetrate the intrinsics of the SSL authentication.. I hope someone can enlighten me.

share|improve this question
    
If you don't get an answer here, try hitting #httpd on freenode. –  mbrownnyc Aug 12 '11 at 14:55

1 Answer 1

up vote 2 down vote accepted

SSLProxyMachineCertificateFile should be what you're looking for; make sure you've got the client certificate in PEM format (must be unencrypted, and both public and private keys in this file - -nodes openssl option) and the device should present that certificate for authentication to the upstream server.

Oh, and semi-unrelated: your ProxyPassReverse's settings look to be backwards; they should usually match ProxyPass. It's unintuitive, but it's there for on-the-fly modification of absolute URL paths that the upstream server sends in headers (it doesn't actually like reversed input).

share|improve this answer
    
Thanks, that did the trick! –  RogerFC Aug 12 '11 at 15:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.