Usually using Apache as reverse proxy is done to do SSL offloading and so Apache handles all the SSL stuff and the backend server just manage plain http. But is it possible to do the opposite ? I'm not talking about SSLProxy where Apache and backend communicate through https. I want my backend to negotiate SSL with the client.
A bit about why I need that :
I'm working with client certificate authentication and when authentication fails user get a browser specific non user-friendly error page. So we're creating a diagnostic page to show the user why authentication has failed. This page should allow any certificate in so we can check it our self and find out what's wrong.
At first we tried the optional_no_ca
setting on Apache but it stills do some checks like expiration date. We were able to make it work with Tomcat (also was handy to do it with Java).
For now the only viable solution seems to setup a 2nd server (physical) with tomcat as front. But it seems heavy just to render one page.