Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Context

  • We currently have an Apache web server in the DMZ set up as a reverse proxy and load balancer for two machines running Windows Server 2008 (IIS) inside.
  • The Apache server has a genuine SSL certificate and serves up both http and https, however, the balancer members in the load balancing section are set to: BalancerMember {https://server1} and
    {https://server2}.
  • The IIS web servers have self-signed certificates in order to respond to the https requests.

My question: Do we need to forward any requests from Apache (in the DMZ) to the inside using SSL?

e.g can the reverse proxy forward the requests using HTTP? and if so, why would I choose to forward them with SSL? (how secure is the http line between the dmz and the inside);

In other words, can I totally disable SSL on my inside web servers?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Yes, there's no reason you can't disable SSL between the proxy/LB and the IIS servers, and remove SSL from the IIS servers. Whether you should or not does depend on how much you trust your local network between the DMZ and the IIS.

share|improve this answer
    
That's correct. However, some web applications may try to detect whether the connection is HTTPS. If so, you may need to do something to fake out the load-balanced member into believing that the original request was made over HTTPS. –  200_success Dec 18 '12 at 4:22
    
@200_success Valid point; if the code running on the server varies it's behaviour depending on whether the connection is HTTP/HTTPS then you may need to connect the same way as the client is connecting to the LB to ensure consistent behaviour. –  fukawi2 Dec 18 '12 at 5:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.