Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I need to clarify something that some experts would probably know better about.
there is domain company.com, and there is a web server called server1.domain.com. This server is a dedicated web server, no other roles is installed.

IIS7 is installed on server1.domain.com, and it's opened to the web using http://domain.com/something (a reverse proxy entry).

there is a SSL certificate available when trying to access https://domain.com.

my question is: if i enable BASIC authentication on a web folder(lets call it app1) on the server(server1.domain.com), and access it through the reverse proxy:

(note the S in http) the traffic that come from the reverse proxy to server1.domain.com is NOT secure. Am I correct?

the traffic that originates from client to domain.com IS SECURE. Does this mean user name and password travel from domain.com to server1.domain.com in base 64 CLEAR text? My reasoning is:

by the time username and password gets to domain.com, they will be decrypted, but they still need to travel to server1.domain.com. am i correct?

If so, how do i ensure secured traffic from domain.com to server1.domain.com? do i need to request to create reverse proxy mapping so that point to ??

share|improve this question

1 Answer 1

The proxied traffic might be encrypted, but this wouldn't be the normal way to handle this, most places considering their inside network "secure".

It would be possible to configure the proxied traffic to use HTTPS. This would require a self-signed (or enterprise/private signed) certificate, if you aren't willing to shell out the cash for another public CA cert.

share|improve this answer
    
when i look at the web log on server1.domain.com, all the traffic are coming in from the proxy server are over port 80, which means it's no longer encrypted. Even if i do an httpS request, after the traffic gets to server1.domain.com, it's still arriving at port 80 –  iisfan Sep 7 '11 at 13:16
    
Configure the proxy server to make requests to server1.domain.com; –  Jeff Warnica Sep 7 '11 at 14:10
    
Jeff meant https://server1.domain.com. The S makes the proxy connection encrypted too. –  Christopher Karel Sep 7 '11 at 15:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.