How to configure JBoss for SSL using F5 Load Balancer

Question

I am having troubles configuring JBoss for a secure environment.

Here's our environment:

We have an F5 Loadbalancer which has our domain's wildcard certificate.

I have several applications running on JBoss on a server called peanut.

From within our firewall, I can run the application as http://peanut.mydomain.com:8080

From the other side of the firewall, the server is only accessible over HTTPS under the subdomain https://pule.mydomain.com:8080

The Loadbalancer has the certificate. So any requests for https://pule.mydomain.com reach the Loadbalancer securely. Between the Load Balancer and peanut, the requests are http.

Now this app uses AJAX calls and web services. From outside the Loadbalancer, I call https://pule.mydomain.com:8080 - but because the communication between the Loadbalancer and peanut is http, the webpage returned references http://pule.mydomain.com:8080.

http://pule.mydomain.com is not accessible anywhere, and the AJAX calls fail.

My question is, how do I configure JBoss to use https always, but without needing a it's own certificate?

This is what I have, and it is not working. I don't think I need to redirect to port 8443, because there is no secure connection between the firewall and the jboss server.

<Connector port="8080" address="${jboss.bind.address}"    
     maxThreads="250" maxHttpHeaderSize="8192"
     emptySessionPath="true" protocol="HTTP/1.1"
     enableLookups="false"  acceptCount="100"
     connectionTimeout="20000" disableUploadTimeout="true" scheme="https" />

Answer 1

Try adding secure=true to your connector. Assuming your application is depending on the result of "request.isSecure()" to determine whether or not to use https when building those references, that would solve the problem.

Answer 2

You need to configure your F5 device to do URL rewriting, and probably also to add the ProxyPass iRule (registration required) mentioned at the bottom of that article.