Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I just purchased an EV SSL and now need some guidance on how to install it.

I followed the step provided to me by Geotrust, but I can't figure out where to toss in my Proxy server into the mix.

The domain points to my proxy server, which then well proxy's in the content from my second server.

In my proxy server I have this in my httpd.conf

<VirtualHost *:80>
    ProxyPreserveHost On
    ProxyPass / http://xx.xx.xxx.xx:80/ connectiontimeout=300 timeout=300
    ProxyPassReverse / http://xx.xx.xxx.xx:80/
</VirtualHost *:80>

in my web server I have

ServerName domain.com
ServerAlias www.domain.com

DocumentRoot "/var/www/html"

<Directory "/var/www/html">
    AllowOverride All
        Order allow,deny
        Allow from all
</Directory>

I don't know where to insert this bit of code

SSLEngine on
SSLCertificateFile /path/to/public_ee.crt
SSLCertificateKeyFile /path/to/private.key
SSLCertificateChainFile /path/to/EV_intermediate.crt

If I add this to my webserver, then I get a "Bad Request" error from the proxy, but I can still access the url via https

Any clues on how to properly configure this type of setup?

Thank you for your help

share|improve this question
    
Why are you proxying apache through apache? –  womble Jul 18 '12 at 0:12
    
to redirect my domain to another IP –  s2xi Jul 18 '12 at 0:14
    
That's a really bad way of achieving that goal. –  womble Jul 18 '12 at 0:20
    
how would i be able to mask my webservers IP? –  s2xi Jul 18 '12 at 0:23

1 Answer 1

up vote 4 down vote accepted

Since your proxy is going to be your "front door", you need to configure a separate https VirtualHost to run there. The SSL directives will go into that VH. It is likely that the default ssl.conf that came with your Apache setup contains everything you need to get that server running.

I run something similar, and have found it useful to bring up SSL in three steps:

  1. Get a _default_:443 server running standalone on the front door
  2. Get the proxy directives working properly out of the SSL VirtualHost
  3. Change the port 80 VirtualHost to redirect to the SSL server

That last step isn't strictly necessary for many people, but it is required in my environment. You don't necessarily need to run SSL between your proxy front end and your services layer, but if you do the setup is similar.

share|improve this answer
    
thank you for the clarification. I do see the ssl.conf that shipped with Apache. So what you are saying is that I need to do a <VirtualHost *:443> And insert my SSL certificate code there? Or let the ssl.conf file do that it needs to do? –  s2xi Jul 18 '12 at 0:09
    
Personal preference (or maybe site preference). I would suggest you start by editing the standard ssl.conf to point to your certificate, bundle, etc. (my step #1 above). Then you can include your proxy directives into that VH (my step #2). GL. –  khoxsey Jul 18 '12 at 16:21
    
So I was able to follow your instructions and get the certificate installed. But now when i access the HTTPS version of my site (via the proxy) I get a Your browser sent a request that this server could not understand.<br /> Reason: You're speaking plain HTTP to an SSL-enabled server port. –  s2xi Jul 18 '12 at 18:14
    
Without seeing your two VirtualHost configs (port 80 and port 443) it's hard to know, but I would suggest commenting out the proxying and getting your front end server handling static pages correctly. Only then can keep proxy issues separate from SSL issues. –  khoxsey Jul 18 '12 at 19:31
    
Clear example of the two VirtualHosts for a CentOS setup here. –  khoxsey Jul 18 '12 at 19:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.