Tomcat 6 behind Pound reverse proxy

Question

I'm trying to run Tomcat as standalone web server behind Pound. Pound is already used to terminate SSL connections for some other machines and so I'd thought it would also do it for the Tomcat server as well.

My problem is that I can't configure Tomcat to handle getting proxy-ed by Pound.

Standard connector configuration in /etc/tomcat6/server.xml is something like

<Connector port="8080" 
protocol="HTTP/1.1"
connectionTimeout="20000"/>

but this causes browser requests to get redirected to http instead of https.

(Of course, firewalls are properly configured to allow port 8443 to Pound and, internally, port 8080 from the Pound host to the Tomcat host.

Changing the above connector config to

<Connector port="8080"
protocol="HTTP/1.1"
proxyPort="8443"
proxyName="my.domain.com" 
connectionTimeout="20000"/>

gets me "The service is not available. Please try again later."

Any suggestions that do not include terminating SSL on the Tomcat?

UPDATE: Apparently, while I was going all over the place trying to find what's wrong I managed to misconfigure Pound and configure Tomcat correctly at the same time. Remember kids, always re-check your config files.

The connector config that worked for me eventually is

<Connector port="8080" protocol="HTTP/1.1."
proxyPort="8443"
proxyName="my.domain.com"
connectionTimeout="20000"
scheme="https" />

And of course, Pound should be directed to port 8080 and not the one I mistyped (8081).

Answer 1

It seems you want to terminate SSL on Pound, and then send all requests to Tomcat over http. Your Tomcat connector is listening on port 8080.

Try altering your Connector so that proxyPort="443"

proxyPort="443"

There is no need to concern yourself with port 8443. If you were terminating SSL on Tomcat, then this is the default listening port Tomcat uses for https. As you want to terminate SSL on Pound, port 8443 doesn't come into play.

There could be a few more things lurking behind the scenes that keeps this from working. Without more information about how your setup reacts to https requests, this is the best I can do for you.