Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to set up an HTTP reverse proxy to an internal HTTPS server. As a sidenote, yes, I know I am throwing all security away. The original HTTPS server is not sensitive in nature for us, and the product that runs it does not allow turning off HTTPS or reconfiguring the embedded webserver in any way.

I have tried with Nginx, but most people out there seem to be using Apache, so that's what I'm trying now.

This is my current virtual host configuration:

<VirtualHost 0.0.0.0:10443>
    ServerName server.domain.com

    SSLProxyEngine on
    #UnknownSSLDirectives
    #SSLProxyMachineCertificateFile /etc/apache2/selfsignedcert.pem
    SSLProxyCACertificateFile /etc/apache2/selfsignedcert.pem

    ProxyRequests Off
    ProxyPass / https://internalserver.internaldomain.com:2941/
    ProxyPassReverse / https://internalserver.internaldomain.com:2941/

    <Proxy>
        Order Deny,Allow
        Allow from all
    </Proxy>

    RequestHeader unset Authorization

    ErrorLog /var/log/apache2/internalserver-error.log
    CustomLog /var/log/apache2/internalserver-access.log common

</VirtualHost>

When I try to open http://server.domain.com:10443/ I get the error "401 Unauthorized".

In other ServerFault questions I saw references to UnknownSSLDirectives, but Apache complains that the option doesn't exist. And to using SSLProxyMachineCertificateFile instead of SSLProxyCACertificateFile, but Apache complains that the SSL setup is incomplete in that case.

I am quite stuck. How can I debug this or make some progress? Thank you!

share|improve this question
    
What does the error log say? –  Jenny D Feb 21 '13 at 7:33
    
Do you mean the error log of Apache or of the HTTPS server? The Apache error log shows no error. I believe the 401 is coming from the HTTPS server. –  UrkoM Feb 21 '13 at 7:40
    
I was thinking of your server, but if there's nothing in its error log then I agree that it's likely the problem is with the server you're connecting to. In which case it'd be useful to look at its error logs to see why it doesn't like those connections. –  Jenny D Feb 21 '13 at 7:44
    
I'm far from optimistic about getting any useful log out of that server... Do you think I could glean something useful if I use a sniffer on the traffic between Apache and the HTTPS server? –  UrkoM Feb 21 '13 at 8:08
    
I'd start by using openssl s_client -connect internalserver.internaldomain.com:2941 to see if you can get access the site then. –  Jenny D Feb 21 '13 at 8:27
show 1 more comment

1 Answer

I don't have an answer, but here are some suggestion for debugging the problem.

I'd try to go with "reverse SSL termination" using stunnel in client mode (http://www.thegoldfish.org/2010/01/stunnel-in-client-mode/), and try whether I can connect to http directly via stunnel on a high port (via curl / lynx / tunneling the high port via ssh). At this moment, I deal only with ssl client, and not with Apache's proxy settings.

When I got this working, I'd try to set up plain unencrypted http proxy in Apache to the stunnel port. I got decryption part working, and unencrypted http proxy in Apache is a known and well documented setup. Also, I can use a sniffer (such as tcpdump) to listen on communication between Apache and unencrypted stunnel socket.

Only after this is working, I'd try to figure out how to remove the stunnel middleman and make Apache itself talk https.

Side note: I'd expect some problems with authentication if the backend service sets the secure flag on cookies, and browser believes it's on unencrypted http. Some other headers and redirects may also create problems. In any case, debug the service with curl -v before using browser, and use a Web inspector (such as Firebug) to inspect request/response headers and cookies.

share|improve this answer
    
Thank you! I'll give all your tips a shot! –  UrkoM Feb 25 '13 at 4:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.