Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I followed this guide:

Here is my virtual host definition

<VirtualHost *:443>
    SSLEngine on
    SSLProxyEngine On
    RequestHeader set Front-End-Https "On"
    CacheDisable *
    DocumentRoot "/Users/me/projects/myproject/public"
    ServerAlias *
    SSLCertificateKeyFile "/private/etc/apache2/certs/webserver.nopass.key"
    SSLCertificateFile "/private/etc/apache2/certs/newcert.pem"
    SSLCACertificateFile "/private/etc/apache2/certs/demoCA/cacert.pem"
    SSLCARevocationPath "/private/etc/apache2/certs/demoCA/crl"
    ErrorLog "/Users/me/Desktop/ssl.log"

    ProxyPass / https://localhost:3002/
    ProxyPassReverse / https://localhost:3002
    ProxyPreserveHost on    

And when I try connecting to the sevre viov the web browser, I get this error:

[Thu Feb 02 16:50:40 2012] [error] (502)Unknown error: 502: proxy: pass request body failed to (localhost)
[Thu Feb 02 16:50:40 2012] [error] [client] proxy: Error during SSL Handshake with remote server returned by /session/new
[Thu Feb 02 16:50:40 2012] [error] proxy: pass request body failed to (localhost) from ()

how do I debug / fix this?

share|improve this question

migrated from Feb 3 '12 at 20:00

This question came from our site for professional and enthusiast programmers.

Voting to move to ServerFault: off-topic here. – Bruno Feb 2 '12 at 22:05
I'd be ok with that. Wherever the most help is ^^ – NullVoxPopuli Feb 2 '12 at 22:24
instead of re-posting, your should flag it and ask to have it moved. – Bruno Feb 3 '12 at 14:55
This may be a possible solution as well: – Marshmellow1328 Apr 16 '13 at 1:03
This is a possible solution as well: – Marshmellow1328 Apr 16 '13 at 1:08

To add to vbartoni's answer, it seems that from Apache 2.4 and up, there are different defaults and a new directive.

I am running Apache 2.4.6, and I had to add the following directives to get it working:

SSLProxyEngine on
SSLProxyVerify none 
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
share|improve this answer
That does the job - only with all those directives its not gonna complain. – Michael Böckling Aug 25 '14 at 17:30
@MichaelBöckling Thank you that held me up. I want to point out specifically that the documentation states that SSLProxyCheckPeerName supersedes SSLProxyCheckPeerCN but it won't work unless you specify all of the directives. – dualed Apr 24 '15 at 16:37

I had a similar problem (the same error logs), except that the proxy was forwarding https traffic to another host.
Since I was lazy and the hosts are in my own isolated network, these directives solved the problem:

SSLProxyVerify none
SSLProxyCheckPeerCN off

share|improve this answer

Don't bother with HTTPS between your front-end and your back-end server, there's little point in enabling SSL for a localhost connection.

To clarify, use ProxyPass / http://localhost:3002/ instead of ProxyPass / https://localhost:3002/

Alternatively, if you really want to connect your reverse proxy to the back-end server using SSL as well (mostly useful when that server isn't where the Apache Httpd reverse proxy is), in addition to https://backend-server-address, use the SSLProxy* directives to set up the CA certs, as documented in the introduction to the mod_proxy documentation. In particular, you would need to configure SSLProxyCACertificateFile and make sure the certificate of the backend server is issued to the right host name as seen by Apache Httpd (i.e. localhost in your case).

If you're not connecting to your back-end server using SSL, it may fail to detect you're actually using SSL and be configured to force you to go to SSL (hence the infinite redirects). You may want to look at similar mechanisms as what Jetty does with its forwarded option (to be able to tell the back-end it's behind a proxy). Rails might be able to interpret the X-Forwarded-Proto by default. In this case, add this to your Apache config (in the SSL virtual host):

RequestHeader set X-Forwarded-Proto 'https'

There seems to be a similar issue discussed here, for example.

share|improve this answer
SSLProxy is only mentioned once on that link. No examples of how to use it. I changed the request header to be set X-Forwarded-Proto 'https'... but it still doesn't work / I get the same error. Going to localhost:3002 also gives the same error – NullVoxPopuli Feb 6 '12 at 13:26
There are valid reasons for connecting to https with localhost: example in an HTTPS back-end. It will through errors with mixed content. – Florestan06 Jun 17 '15 at 9:45

If the backend server uses out-of-date self signed certificate, one more option is needed (if there is no access to the backend server):

SSLProxyCheckPeerExpire off

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.