Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My web servers need to integrate with a 3rd party's server that sits behind a firewall. In order to get through the firewall all requests have to come from the same IP address and be authenticated via SSL. So I set up a machine that's supposed to work as a proxy and forward all traffic via SSL to the 3rd party server.

I set up the proxy with the certificates and matching key files and can make a successful request to the 3rd party service via CURL just fine, using the certificate and key file. I sey up a virtual host on Apache to pass these requests through, but keep getting errors saying that the SSL handshake with the remote server failed. I see the following error messages in my apache logs:

Proxy client certificate callback: (:443) downstream server wanted client certificate but none are configured [Sun Jul 29 01:40:48 2012] [error] (502)Unknown error 502: proxy: pass request body failed to <3rd party IP>:18443 (<3rd party URL>)
[Sun Jul 29 01:40:48 2012] [error] [client ] proxy: Error during SSL Handshake with remote server returned by /

My apache virtual host configuration looks as follows:

<VirtualHost *:18443>
    ServerName <Proxy IP>
    SSLEngine on
    SSLProxyEngine On
    SSLCertificateFile /etc/apache2/ssl/my_server.pem
    SSLCertificateKeyFile /etc/apache2/ssl/my_server.key
    SSLProxyCACertificatePath /etc/ssl/certs
    ProxyRequests Off
    ProxyPreserveHost On
    <Proxy *>
    Order deny,allow
    Allow from all
    </Proxy>
    ProxyPass / https://<3rd party server address>:18443
    ProxyPassReverse / https://<3rd party server address>:18443
</VirtualHost>

Thank you! Any help is highly appreciated!

share|improve this question
1  
Just a hunch, but can you post the config for whatever is listening on :443? Based on your log snippet something is trying to establish an SSL connection on :443 and then getting redirected to :18443. –  d34dh0r53 Jul 29 '12 at 2:13
    
I am not sure what's up with that. I made the request via cURL to :18443. So I am not sure why it comes in on :443. I also checked with netstat and it's apache listening on that port. However, I didn't change anything (knowingly) about responses on :443. The apache.conf doesn't mention anything about it either. –  ajmurmann Jul 29 '12 at 2:38

2 Answers 2

up vote 2 down vote accepted

You need to configure Apache to use that certificate file as an authentication mechanism to its proxy backend.

Combine the .pem and .key into one file, and point to it with:

SSLProxyMachineCertificateFile /path/to/combined.pem
share|improve this answer
    
Thank you very much! That fixed that error. However, now I am getting "502)Unknown error 502: proxy: pass request body failed". As you recommended elsewhere, I turned off SSLProxyCheckPeerCN, but to effect. –  ajmurmann Jul 29 '12 at 16:27
1  
@ajmurmann Hmm. Try also changing your ProxyPass to add a trailing slash, as well: ProxyPass / https://<3rd party server address>:18443/ –  Shane Madden Jul 29 '12 at 17:54
    
Thanks for that as well. However, I already tried that based on you advise on another thread. –  ajmurmann Jul 29 '12 at 19:46

Imho what he is really asking for, is an Apache that proxies the SSL requests to an endpoint server, presumably an application server, that does SSL client certificate authentication...

The SSLProxyMachineCertificateFile will not help you in this case as this file contains a certificate by which the apache server authenticates itself with the application server... you don't want that: you want the calling client to use his certificate

Presumably it should be possible for Apache to pass the certificate info it obtains on to the app server, e.g. via AJP, but I haven't been able to get this working so far. I will try and update this answer if I get it to work...

share|improve this answer
    
According to this thread on the Apache mailing list, it's not possible to forward the client cert through a proxy to the end server. apache-http-server.18135.n6.nabble.com/… –  Steve Goodman Mar 12 '13 at 18:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.