3

Usually using Apache as reverse proxy is done to do SSL offloading and so Apache handles all the SSL stuff and the backend server just manage plain http. But is it possible to do the opposite ? I'm not talking about SSLProxy where Apache and backend communicate through https. I want my backend to negotiate SSL with the client.


A bit about why I need that :
I'm working with client certificate authentication and when authentication fails user get a browser specific non user-friendly error page. So we're creating a diagnostic page to show the user why authentication has failed. This page should allow any certificate in so we can check it our self and find out what's wrong.
At first we tried the optional_no_ca setting on Apache but it stills do some checks like expiration date. We were able to make it work with Tomcat (also was handy to do it with Java).

For now the only viable solution seems to setup a 2nd server (physical) with tomcat as front. But it seems heavy just to render one page.

4 Answers 4

0

You can't exactly pass it through. But, there are some hacks you can use if you're willing to change your backend. The client certificate is presented as part of TLS negotiation, which by definition can't be passed through.

You can, for example, have Apache parse the certificate and propagate the (authenticated) certificate's particulars through using directives like RequestHeader set SSL_CLIENT_S_DN "%{SSL_CLIENT_S_DN}s". See here for an example.

Of course, to use that for authentication, you would need to restrict access to the backend and use TLS between the proxy and the backend.

2
  • Won't work because this means Apache will handle the client certificate retrieval and so will fail if the certificate is invalid. And that's exactly what we want retrieve invalid certificate. What you are suggesting is what we are doing for the actual login page. Apache handles the retrieval of the certificate (check DN, Signature, Validity, CRL...) and Tomcat then handle the identification part. But on the diagnostic page we don't want Apache to do any check on the client certificate.
    – Ghetolay
    Aug 29, 2015 at 14:24
  • The SSLVerifyClient optional_no_ca directive might get you part of the way there. Aug 29, 2015 at 19:23
0

Apache cannot do this. If you want a proxy inbetween, but no TLS operations from it, your proxy is essentially a TCP tunnel.

A while back, when I wanted to do something similar, I came across sniproxy. It seems to me that it can do what you want. If you need Apache for other parts of your site, you may run Apache behind sniproxy. Keep in mind that, due to the way SNI in SSL/TLS works, you cannot run multiple backends on the same hostname. Use something like www.example.com on Apache and app.example.com for the client certificate app. This is the solution I would recommend if you only have one IP address available.

Another alternative is simply running a TCP proxy, for example using HAproxy, or simply run the application directly on a dedicated IP address. In this situation, however, you lose the possibility to run multiple sites on the same IP address. (no possibility for vhosts). This is the solution I would recommend if you have multiple IP addresses available.

2
  • Are you suggesting sniproxy in front of Apache ? Otherwise I may have forgotten to say that using Apache for the rest of the site is mandatory.
    – Ghetolay
    Aug 29, 2015 at 14:26
  • Changed the answer to take that into account :-)
    – jornane
    Aug 29, 2015 at 16:24
0

If I understand your whole problem well, I can see another, proxy-unrelated solution:

by default, client is landed on the diagnostic page (no cert. required), which makes a background, AJAX query to the protected zone. Depending on the query result, JavaScript redirects to the protected page or shows a message, explaining that something is wrong with the cert.

1
  • Browsers does not handle client certificate on AJAX call. But we are actually doing something similar with an hidden iframe because browsers does ask for client certificate on iframe. Still we are able to know certificate is wrong but not why. The diagnostic page purpose is to find out why certificate is wrong and explain the user what to do from here.
    – Ghetolay
    Aug 29, 2015 at 19:36
0

The essence of https is to make sure client and server sees each other above network layer, therefore apache can't proxy http to https in backend.

Aside from sniproxy which I see in other answer I would suggest haproxy. It's a fast TCP Proxy with many features.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .