Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I followed this guide: http://hints.macworld.com/article.php?story=20041129143420344

Here is my virtual host definition

<VirtualHost *:443>
    SSLEngine on
    SSLProxyEngine On
    RequestHeader set Front-End-Https "On"
    CacheDisable *
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    DocumentRoot "/Users/me/projects/myproject/public"
    ServerName ssl.mydomain.com
    ServerAlias *.ssl.mydomain.com
    SSLCertificateKeyFile "/private/etc/apache2/certs/webserver.nopass.key"
    SSLCertificateFile "/private/etc/apache2/certs/newcert.pem"
    SSLCACertificateFile "/private/etc/apache2/certs/demoCA/cacert.pem"
    SSLCARevocationPath "/private/etc/apache2/certs/demoCA/crl"
    ErrorLog "/Users/me/Desktop/ssl.log"

    ProxyPass / https://localhost:3002/
    ProxyPassReverse / https://localhost:3002
    ProxyPreserveHost on    
</VirtualHost>

And when I try connecting to the sevre viov the web browser, I get this error:

[Thu Feb 02 16:50:40 2012] [error] (502)Unknown error: 502: proxy: pass request body failed to 127.0.0.1:3002 (localhost)
[Thu Feb 02 16:50:40 2012] [error] [client 96.11.81.39] proxy: Error during SSL Handshake with remote server returned by /session/new
[Thu Feb 02 16:50:40 2012] [error] proxy: pass request body failed to 127.0.0.1:3002 (localhost) from 96.11.81.39 ()

how do I debug / fix this?

share|improve this question

migrated from stackoverflow.com Feb 3 '12 at 20:00

This question came from our site for professional and enthusiast programmers.

    
Voting to move to ServerFault: off-topic here. –  Bruno Feb 2 '12 at 22:05
    
I'd be ok with that. Wherever the most help is ^^ –  NullVoxPopuli Feb 2 '12 at 22:24
    
instead of re-posting, your should flag it and ask to have it moved. –  Bruno Feb 3 '12 at 14:55
    
This may be a possible solution as well: serverfault.com/questions/496888/ssl-issue-with-mod-proxy –  Marshmellow1328 Apr 16 '13 at 1:03
    
This is a possible solution as well: serverfault.com/questions/496888/ssl-issue-with-mod-proxy –  Marshmellow1328 Apr 16 '13 at 1:08

3 Answers 3

I had a similar problem (the same error logs), except that the proxy was forwarding https traffic to another host.
Since I was lazy and the hosts are in my own isolated network, these directives solved the problem:

SSLProxyVerify none
SSLProxyCheckPeerCN off

share|improve this answer

To add to vbartoni's answer, it seems that from Apache 2.4 and up, there are different defaults and a new directive.

I am running Apache 2.4.6, and I had to add the following directives to get it working:

SSLProxyEngine on
SSLProxyVerify none 
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
share|improve this answer
    
That does the job - only with all those directives its not gonna complain. –  Buddy Casino Aug 25 at 17:30

Don't bother with HTTPS between your front-end and your back-end server, there's little point in enabling SSL for a localhost connection.

To clarify, use ProxyPass / http://localhost:3002/ instead of ProxyPass / https://localhost:3002/


Alternatively, if you really want to connect your reverse proxy to the back-end server using SSL as well (mostly useful when that server isn't where the Apache Httpd reverse proxy is), in addition to https://backend-server-address, use the SSLProxy* directives to set up the CA certs, as documented in the introduction to the mod_proxy documentation. In particular, you would need to configure SSLProxyCACertificateFile and make sure the certificate of the backend server is issued to the right host name as seen by Apache Httpd (i.e. localhost in your case).


If you're not connecting to your back-end server using SSL, it may fail to detect you're actually using SSL and be configured to force you to go to SSL (hence the infinite redirects). You may want to look at similar mechanisms as what Jetty does with its forwarded option (to be able to tell the back-end it's behind a proxy). Rails might be able to interpret the X-Forwarded-Proto by default. In this case, add this to your Apache config (in the SSL virtual host):

RequestHeader set X-Forwarded-Proto 'https'

There seems to be a similar issue discussed here, for example.

share|improve this answer
    
SSLProxy is only mentioned once on that link. No examples of how to use it. I changed the request header to be set X-Forwarded-Proto 'https'... but it still doesn't work / I get the same error. Going to localhost:3002 also gives the same error –  NullVoxPopuli Feb 6 '12 at 13:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.