Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a custom SPDY-based service running locally on my Apache web server. It serves a REST-style API that will be consumed by a custom SPDY client. My server also serves a standard HTTPS website.

The very short version of my question is: Can I configure Apache to forward TLS traffic to another process without trying to negotiate the TLS itself?

Now more details:

To avoid requiring opening additional ports, I'd like to multiplex these services on 443. I've attempted several approaches without success. My real goal is to get Apache to detect that the stream is destined for my service, and just hand all the bytes (including the initial TLS handshake) to me without getting in the way or trying to interpret the TLS session. My service wants to handle the handshake (and it has its own certificate); it doesn't need Apache to do anything but proxy.

First, I tried a Location and a reverse proxy with mod_proxy_http and mod_ssl. The problem is that my client speaks SPDY, not HTTP/HTTPS, so it can't make the initial request.

I then tried using SNI to request a fake host:

<VirtualHost *:443>
  SSLEngine on
  ServerName myservice
  SSLProxyEngine on
  ProxyRequests Off
  ProxyPass / https://127.0.0.1:12345
  ProxyPassReverse / https://127.0.0.1:12345
  SSLCertificateFile ...
  SSLCertificateKeyFile ...
</VirtualHost>

I connect to "hostname.example.com", but I pass "myservice" in the TLS SNI. Apache still gets involved here and I believe is sending back HTTPS responses.

I assume I can write my own Apache module to act as a pass-through, but I'm trying to determine if there's an existing way to do this.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.