Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm working to set up Apache as a forward proxy with a client that uses 2-way SSL. The basic flow is myApplication --via http--> Apache proxy --via 2 way SSL--> client. After setting everything up, when I try to start Apache, I'm getting a "incomplete client cert configured for SSL proxy (missing or encrypted private key?)" error. What I can't figure out is that the client cert I'm using in the SSLProxyMachineCertificateFile directive has both the unencrypted private key and the public cert already. Any suggestions on what I'm missing and/or anything else I can try? Does the all-in-one machine cert need to have the chain in it as well?

Here's what my vhost looks like.

<VirtualHost *:8082>
    ServerName my.domain.com

    ProxyRequests On
    SSLProxyEngine On

    SSLProxyMachineCertificateFile /etc/httpd/keys/machine.pem
    SSLProxyCACertificateFile /etc/httpd/keys/machine.chain.crt

    ProxyPass / https://target.client.com/
    ProxyPassReverse / https://target.client.com/

    <Proxy *>
            Order deny,allow
            Allow from all
    </Proxy>
</VirtualHost>

EDIT: I updated the basic flow to clarify what kind of connection I'm trying to use between the application, apache, and the client.

share|improve this question
    
what is 2-way-SSL? –  that guy from over there Oct 15 '13 at 5:21
    
Is the private key in machine.pem DES encrypted (the default when generating)? –  Shane Madden Oct 15 '13 at 6:11
    
The all-in-one machine cert should not need to have the chain in it. I would start by trying to connect using without apache, e.g. by doing openssl s_client -connect remoteserver:443 -cert /etc/httpd/keys/machine.pem. The output from that should give you some hint. –  Jenny D Oct 15 '13 at 7:48
    
@ShaneMadden I'm going to say yes. When I generated the key and csr it was a pretty standard generation process and I didn't put a password on the private key. –  Mike Levy Oct 15 '13 at 14:50
    
@JennyD I tried out your suggestion and was able to successfully connect to the remote server using machine.pem. However, I still can't start Apache when using machine.pem as the SSLProxyMachineCertificateFile. –  Mike Levy Oct 15 '13 at 15:04

1 Answer 1

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.