0

I need to clarify something that some experts would probably know better about.
there is domain company.com, and there is a web server called server1.domain.com. This server is a dedicated web server, no other roles is installed.

IIS7 is installed on server1.domain.com, and it's opened to the web using http://domain.com/something (a reverse proxy entry).

there is a SSL certificate available when trying to access https://domain.com.

my question is: if i enable BASIC authentication on a web folder(lets call it app1) on the server(server1.domain.com), and access it through the reverse proxy:

(note the S in http) the traffic that come from the reverse proxy to server1.domain.com is NOT secure. Am I correct?

the traffic that originates from client to domain.com IS SECURE. Does this mean user name and password travel from domain.com to server1.domain.com in base 64 CLEAR text? My reasoning is:

by the time username and password gets to domain.com, they will be decrypted, but they still need to travel to server1.domain.com. am i correct?

If so, how do i ensure secured traffic from domain.com to server1.domain.com? do i need to request to create reverse proxy mapping so that point to ??

1 Answer 1

0

The proxied traffic might be encrypted, but this wouldn't be the normal way to handle this, most places considering their inside network "secure".

It would be possible to configure the proxied traffic to use HTTPS. This would require a self-signed (or enterprise/private signed) certificate, if you aren't willing to shell out the cash for another public CA cert.

3
  • when i look at the web log on server1.domain.com, all the traffic are coming in from the proxy server are over port 80, which means it's no longer encrypted. Even if i do an httpS request, after the traffic gets to server1.domain.com, it's still arriving at port 80
    – iisfan
    Sep 7, 2011 at 13:16
  • Configure the proxy server to make requests to server1.domain.com; Sep 7, 2011 at 14:10
  • Jeff meant https://server1.domain.com. The S makes the proxy connection encrypted too. Sep 7, 2011 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .