I have a custom SPDY-based service running locally on my Apache web server. It serves a REST-style API that will be consumed by a custom SPDY client. My server also serves a standard HTTPS website.
The very short version of my question is: Can I configure Apache to forward TLS traffic to another process without trying to negotiate the TLS itself?
Now more details:
To avoid requiring opening additional ports, I'd like to multiplex these services on 443. I've attempted several approaches without success. My real goal is to get Apache to detect that the stream is destined for my service, and just hand all the bytes (including the initial TLS handshake) to me without getting in the way or trying to interpret the TLS session. My service wants to handle the handshake (and it has its own certificate); it doesn't need Apache to do anything but proxy.
First, I tried a Location and a reverse proxy with mod_proxy_http and mod_ssl. The problem is that my client speaks SPDY, not HTTP/HTTPS, so it can't make the initial request.
I then tried using SNI to request a fake host:
<VirtualHost *:443> SSLEngine on ServerName myservice SSLProxyEngine on ProxyRequests Off ProxyPass / https://127.0.0.1:12345 ProxyPassReverse / https://127.0.0.1:12345 SSLCertificateFile ... SSLCertificateKeyFile ... </VirtualHost>
I connect to "hostname.example.com", but I pass "myservice" in the TLS SNI. Apache still gets involved here and I believe is sending back HTTPS responses.
I assume I can write my own Apache module to act as a pass-through, but I'm trying to determine if there's an existing way to do this.