Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

    Hello everyone. My question is very simple . The link below is a picture about my architecture.

https://docs.google.com/open?id=0BxSXbpgYIZVOR212RVk4ZDN1Sm8.

     The pic above shows the architecture right now and it works correctly! Which means I could visit Apache with url https//apchehost:8080, could not visit the web app with https served by Weblogic but I could visit these app with https served by Apache(Apache is proxy server).
     My question is why the Apache is configured with SSL but Weblogic without SSL works? I think Weblogic should also configured with SSL. If this works , what about security level? Is the SSL really working if only Apache configured with SSL but not with Weblogic? Thanks.

condition:
    Apache 2.2.17 with weblogic module mod_wl_22.so 
    Weblogic: 10.3
    OS: Windows server 2003
share|improve this question
    
Since my server is windows , I have observed tcp connection by netstat -an | find "443" , Apache and weblogic was indeed not communicate on port 443. –  huangli Jun 15 '12 at 8:15
add comment

2 Answers

up vote 3 down vote accepted

A setup like this with the web server in a DMZ and the clients unable to access the Weblogic hosts directly is quite common. Client HTTPS connections terminate at the web server on the DMZ and authentication and authorisation takes place there. If this is successful then the connections are proxied as HTTP down to the application layer.

As long as it is not possible for clients to connect to the Weblogic hosts directly then this is quite safe and has the advantage that all of the SSL configuration is in once place on the web server.

share|improve this answer
add comment

Once the traffic hits the apache server it is decrypted. When it is proxied, the traffic on the other side of the apache machine is not encrypted any more. You could turn ssl on for the weblogic servers but that gets a little tricky with making sure the apache machine trusts the CA for the connection and also adds extra ssl overhead.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.