Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running an application on Tomcat7 with Apache Portable Runtime, I bought an SSL certificate and configured it correctly - when I try to connect through the ip:port combination, it connects fine but warns me the certificate is issued to the domain name, not the IP.

The VPS I'm on doesn't have SELinux (and there's an issue installing), which is AFAIK required to have SSL be configured in apache, so I want to just route the requests to Tomcat, which does it on its end.

I configured apache to proxy the connections, first with port 80 that works perfectly:

ProxyPreserveHost On
ProxyRequests Off
ProxyPass / http://localhost:8180/MYSITE/
ProxyPassReverse / http://localhost:8180/MYSITE/
ProxyPassReverseCookiePath /MYSITE/ /

And then with the SSL port that doesn't want to work for some reason:

        SSLProxyEngine On
        ProxyPreserveHost On
        ProxyRequests Off
        ProxyPass / https://localhost:8443/MYSITE/
        ProxyPassReverse / https://localhost:8443/MYSITE/
        ProxyPassReverseCookiePath /MYSITE/ /
        CacheDisable *

EDIT: I added the

RequestHeader set Front-End-Https "On"

directive to the VirtualHost, as per:

Here is the Tomcat APR Connector as configured in Tomcat's server.xml -

<Connector port="8443" maxHttpHeaderSize="16500"
                 enableLookups="false" disableUploadTimeout="true"
                 acceptCount="100" scheme="https" secure="true"

There were no errors/warnings enabling the virtual hosts and restarting apache. When I try to https, this is what I see in FFox:

SSL received a record that exceeded the maximum permissible length.

(Error code: ssl_error_rx_record_too_long)

And in Chromium:

Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error.

Apache's error.log shows this warning message:

[warn] [client] proxy: no HTTP 0.9 request (with no host line) on incoming request and preserve host set forcing hostname to be for uri /

I've spent days trying to configure it, and would be very grateful if someone explained what's going on and how to fix it.

Many thanks. Victor.

share|improve this question
up vote 4 down vote accepted

The error you're getting is probably due to the fact that your client (Firefox) is trying to use SSL, but you Apache virtual host does not have SSL enabled.

In order for your clients to be able to communicate via SSL with your front-end proxy, you're going to need to do SSL on the front-end, not in Tomcat. You gain absolutely nothing by using SSL between Apache and Tomcat.

In your <VirtualHost> block, you're going to need at least:

SSLEngine On
SSLCertificateFile ...
SSLCertificateKeyFile ...

Also, note htat SELinux has absolutely nothing to do with SSL, other than the fact that a misconfigured SELinux environment could prevent Apache from being able to read the necessary SSL certificates.

If you're not using Apache as anything other than a simple proxy and you're really not comfortable with Apache configuration you could in theory get rid of it and just have Tomcat listen on port 443 (by modifying the appropriate Connector block).

share|improve this answer
Thanks for your answer! I was under the impression the "RequestHeader set Front-End-Https "On"" directive instructed Apache to terminate SSL on the back end of the proxy. – vivri Aug 9 '13 at 18:52
The RequestHeader directive only modifies headers, it doesn't have any operational impact. – larsks Aug 9 '13 at 19:09
I tried to https locally (wget localhost:8443/MYSITE), and it was refused because the cert was issued for and not the local ip.. maybe that's the issue? In that case, I'll really have to configure SSL on Apache... – vivri Aug 9 '13 at 19:51
You have to configure SSL in Apache in any case. In you current configuration Apache is speaking normal HTTP while your clients are trying to speak SSL. – larsks Aug 9 '13 at 19:56
I think someone figured it out w/o configuring apache -, but it didn't work for me. Is it possible though? – vivri Aug 9 '13 at 20:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.