# I have a proxy server pointing to my web server, where do I install my SSL?

I just purchased an EV SSL and now need some guidance on how to install it.

I followed the step provided to me by Geotrust, but I can't figure out where to toss in my Proxy server into the mix.

The domain points to my proxy server, which then well proxy's in the content from my second server.

In my proxy server I have this in my httpd.conf

<VirtualHost *:80>
ProxyPreserveHost On
ProxyPass / http://xx.xx.xxx.xx:80/ connectiontimeout=300 timeout=300
ProxyPassReverse / http://xx.xx.xxx.xx:80/
</VirtualHost *:80>


in my web server I have

ServerName domain.com
ServerAlias www.domain.com

DocumentRoot "/var/www/html"

<Directory "/var/www/html">
AllowOverride All
Order allow,deny
Allow from all
</Directory>


I don't know where to insert this bit of code

SSLEngine on
SSLCertificateFile /path/to/public_ee.crt
SSLCertificateKeyFile /path/to/private.key
SSLCertificateChainFile /path/to/EV_intermediate.crt


If I add this to my webserver, then I get a "Bad Request" error from the proxy, but I can still access the url via https

Any clues on how to properly configure this type of setup?

-
Why are you proxying apache through apache? –  womble Jul 18 '12 at 0:12
to redirect my domain to another IP –  s2xi Jul 18 '12 at 0:14
That's a really bad way of achieving that goal. –  womble Jul 18 '12 at 0:20
how would i be able to mask my webservers IP? –  s2xi Jul 18 '12 at 0:23

Since your proxy is going to be your "front door", you need to configure a separate https VirtualHost to run there. The SSL directives will go into that VH. It is likely that the default ssl.conf that came with your Apache setup contains everything you need to get that server running.

I run something similar, and have found it useful to bring up SSL in three steps:

1. Get a _default_:443 server running standalone on the front door
2. Get the proxy directives working properly out of the SSL VirtualHost
3. Change the port 80 VirtualHost to redirect to the SSL server

That last step isn't strictly necessary for many people, but it is required in my environment. You don't necessarily need to run SSL between your proxy front end and your services layer, but if you do the setup is similar.

-
thank you for the clarification. I do see the ssl.conf that shipped with Apache. So what you are saying is that I need to do a <VirtualHost *:443> And insert my SSL certificate code there? Or let the ssl.conf file do that it needs to do? –  s2xi Jul 18 '12 at 0:09
Personal preference (or maybe site preference). I would suggest you start by editing the standard ssl.conf to point to your certificate, bundle, etc. (my step #1 above). Then you can include your proxy directives into that VH (my step #2). GL. –  khoxsey Jul 18 '12 at 16:21
So I was able to follow your instructions and get the certificate installed. But now when i access the HTTPS version of my site (via the proxy) I get a Your browser sent a request that this server could not understand.<br /> Reason: You're speaking plain HTTP to an SSL-enabled server port. –  s2xi Jul 18 '12 at 18:14
Without seeing your two VirtualHost configs (port 80 and port 443) it's hard to know, but I would suggest commenting out the proxying and getting your front end server handling static pages correctly. Only then can keep proxy issues separate from SSL issues. –  khoxsey Jul 18 '12 at 19:31
Clear example of the two VirtualHosts for a CentOS setup here. –  khoxsey Jul 18 '12 at 19:52