Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i m trying to setup Apache with SSl and proxy SSL requests to my tomcat instance. I think i made the SSL work but theres still a error that shows up:

Bad Gateway

The proxy server received an invalid response from an upstream server.

* SSL Virtualhost *

LoadModule ssl_module modules/mod_ssl.so

Listen 443
<VirtualHost _default_:443>
SSLEngine On
SSLProxyEngine On
DocumentRoot "/var/apache-tomcat-7.0.34/webapps/Learn2Gether/"

SSLCertificateFile /etc/pki/tls/learn2gether/cert-6090205098829887.pem
SSLCertificateKeyFile /etc/pki/tls/learn2gether/private_key_unlocked.pem
SSLCertificateChainFile /etc/pki/tls/learn2gether/rubca-chain.pem


BrowserMatch ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

ServerName www.learn2gether.rubel.rub.de
ServerAlias learn2gether.rubel.rub.de

#RewriteRule ^\/$ /Learn2Gether/index.html [PT]
##RewriteRule ^/(.*)$ /$1 [PT]

ProxyRequests Off
ProxyPreserveHost On
ProxyPass / https://localhost:8443/
ProxyPassReverse / https://localhost:8443/

</VirtualHost>
~               

HTTP VH redirect to HTTPS

NameVirtualHost *:80

<VirtualHost _default_:80>
   ServerName www.learn2gether.rubel.rub.de
   ServerAlias learn2gether.rubel.ruhr-uni-bochum.de
RewriteEngine on
# DocumentRoot "/var/apache-tomcat-7.0.34/webapps/Learn2Gether/"
RewriteCond %{HTTP_HOST} !^learn2gether.rubel.ruhr-uni-bochum\.de [NC]
RewriteRule ^/(.*)$ http://learn2gether.rubel.ruhr-uni-bochum.de/$1 [R=301,L]

RewriteCond %{SERVER_PORT} !^443$
RewriteRule (.*) https://%{HTTP_HOST}$1 [L]

#RewriteRule ^\/$ /Learn2Gether/index.html [PT]
#RewriteRule ^/(.*)$ /$1 [PT]

#ProxyPass / https://localhost:8443/
#ProxyPassReverse / https://localhost:8443/
</VirtualHost>

Tomcats apache connector

    <Connector port="8443"
  protocol="HTTP/1.1"
   connectionTimeout="20000"
    compression="on"
     compressionMinSize="32"
      noCompressionUserAgents="gozilla, traviata"
       compressableMimeType="text/html,text/xml,text/javascript,application/x-javascript,text/css"
        redirectPort="8443"
         URIEncoding="UTF-8"
          proxyPort="443"
           proxyName="learn2gether.rubel.ruhr-uni-bochum.de"
            scheme="https"
             secure="true"
/>
share|improve this question
    
Is the tomcat server configured with a self signed certificate? Also, if you are using apache as an ssl frontend for tomcat why are you using ssl on the tomcat server as well? Best practice is to just have your tomcat respond to http, and offload https to the apache server. –  Krist van Besien May 6 '13 at 14:45

1 Answer 1

up vote 1 down vote accepted

When proxying http or https to https you need to configure apache as an ssl client. When apache talks to your Tomcat server it functions as a web client after all. However Apache will usually not function as an SSL client out of the box.

Firstly I would suggest that you first consider if you really need this, why you are doing this. The common practice when Tomcat and Apache live on the same server is to have Tomcat just serve plain http (or ajp) and offload ssl to the Apache server. There is usually no need to have ssl between the apache and tomcat server. Not having ssl on the tomcat server is going to save you a lot of trouble.

All you need to do is for example define a HTTP connector on port 8080 in your tomcat instance, and redirect all requests there from within your apache SSL virtual host:

<VirtualHost _default_:443>
SSLEngine On

SSLCertificateFile /etc/pki/tls/learn2gether/cert-6090205098829887.pem
SSLCertificateKeyFile /etc/pki/tls/learn2gether/private_key_unlocked.pem
SSLCertificateChainFile /etc/pki/tls/learn2gether/rubca-chain.pem


BrowserMatch ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

ServerName www.learn2gether.rubel.rub.de
ServerAlias learn2gether.rubel.rub.de

ProxyRequests Off
ProxyPreserveHost On
ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/

</VirtualHost>

But if you still decide you do need ssl to ssl proxying you will need to add more changes. Apache needs to be able to function as an SSL client, as well as SSL server. When Apache talks to another server using https it is after all taking the role of client. This is not that easy, and there are a lot of problems you can run in to. You will need to add this:

# turn on SSL proxying.
SSLProxyEngine On

# to tell Apache where to find CA certificates to check server certificates with:
# (You can choose yourself where you put these certificates)
SSLProxyCACertificatePath /path/to/ca/certificates.

Then in this path you need to put the CA certificat used to sign the certificat used by the server you communicate with. If you use a "self signed" certificate you will need to put it in this dir.

Once you've done that you need to run "c_rehash" in that directory. c_rehash is part of a standard openssl distribution. c_rehash creates hashed aliases in this dir. Apache needs these.

In order to test if everything is there you can do the following:

 openssl s_client -CApath /path/to/ca/certificates -connect remoteserver:8443

if the connenction succeeds you'll get a prompt where you can type in a request. Just try something.

 GET /

and see if you get something. If this test is succesfull apache should work too.

You can now add the ReWriteRule or Proxy statements to forward the connections to your https server.

share|improve this answer
    
i m really new to that.. how can i use apache just for ssl and redirect just with http? –  SaifDeen May 7 '13 at 6:07
    
sounds for me easier.. i just want ssl for the front end... –  SaifDeen May 7 '13 at 6:08
    
If you just want to use apache as ssl frontend for Tomcat all you have to do is configure a http or ajp connector on your tomcat server, and have apache forward requests to it. –  Krist van Besien May 8 '13 at 20:21
    
ill try that out at monday! –  SaifDeen May 9 '13 at 9:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.