37

I am using an apache (2.4) server configured as loadbalancer in front of 2 apache servers. It works fine when I use http connections between loadbalancer and backends, however using https does not work. The configuration of the loadbalancer:

SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
<Proxy balancer://testcluster>
  BalancerMember https://[Backend1]:443/test
  BalancerMember https://[Backend2]:443/test
</Proxy>
ProxyPass /test balancer://testcluster

The backends only have self-signed certificates for now which is why the certificate verification is disabled.

The error-log on the loadbalancer contains the following:

[proxy:error] [pid 31202:tid 140325875570432] (502)Unknown error 502: [client ...] AH01084: pass request body failed to [Backend1]:443 ([Backend1])
[proxy:error] [pid 31202:tid 140325875570432] [client ...] AH00898: Error during SSL Handshake with remote server returned by /test/test.jsp
[proxy_http:error] [pid 31202:tid 140325875570432] [client ...] AH01097: pass request body failed to [Backend1]:443 ([Backend1]) from [...] ()

The error-page in the browser contains:

Proxy Error

The proxy server could not handle the request GET /test/test.jsp.
Reason: Error during SSL Handshake with remote server

As I already stated above changing the configuration to the http protocol and port 80 works. Also https connections between the client and loadbalancer work, so the ssl module of the loadbalancer seems to be setup properly. Connecting directly to the backend via https also does not yield any errors.

Thanks in advance for your time


Edit: I figured it out, the problem is that my certificates common name does not match the server name. I thought SSLProxyVerify none would cause this mismatch to be ignored, but it doesn't. Prior to apache 2.4.5 this check can be disabled using SSLProxyCheckPeerCN off but on higher versions (I am using 2.4.7) SSLProxyCheckPeerName off also needs to be specified.

Apache documentation for sslproxycheckpeername

The working configuration looks like this:

SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off

<Proxy balancer://testcluster>
  BalancerMember https://[backend1]:443/test
  BalancerMember https://[backend1]:443/test
</Proxy>
ProxyPass /test balancer://testcluster

Unfortunately I can't answer my own question for lack of reputation so I edited my question, I hope this helps anyone who encounters a similar problem

2
  • Interesting. I used to do this with apache2.2 and never had to so SSLProxyVerify none and never had problems with self-sign certs. You sure the backend server is fine.?
    – ETL
    Feb 22, 2014 at 20:49
  • @ETL I don't know if "SSLProxyVerify none" is required or not, I just added that in the hope it might fix the issue. Calling "wget https://[backend1]/test/test.jsp --no-check-certificate" on the load-balancer server downloads the expected file. ng Feb 22, 2014 at 21:26

3 Answers 3

25

The problem turned out to be that the certificates common name did not match the server name.

Prior to Apache 2.4.5 this check can be disabled using SSLProxyCheckPeerCN off but on higher versions (such as 2.4.7) SSLProxyCheckPeerName off also needs to be specified.

Apache documentation for SSLProxyCheckPeerName

The working configuration looks like this:

SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off

<Proxy balancer://testcluster>
  BalancerMember https://[backend1]:443/test
  BalancerMember https://[backend1]:443/test
</Proxy>
ProxyPass /test balancer://testcluster

You can check the version of Apache that you have with:

apachectl -V

and/or

apache2ctl -V
2
  • Hey I have the exact same problem except the configuration is little different: <Location /margin-tool> ProxyPass https://xxxx.thoughtworks.net:8443/margin-tool ProxyPassReverse https://xxxx.thoughtworks.net:8443/margin-tool </Location> Same settings are not working. Any ideas?
    – user157735
    Aug 4, 2017 at 9:30
  • Got here due to similar errors. Resolution in my specific case was to use DNS name for BalancerMember rather than IP address. Common name now matched name on certificate, so Apache handled it properly--without need to resort to SSLProxyVerify, SSLProxyCheckPeer... elements required for the above answer. Dec 15, 2021 at 2:31
0

Adding below solved the problem

SSLProxyProtocol +TLSv1
2
  • 8
    Giving mystical config samples isn't a well-quality answer. Copy-pasting strings from the internet isn't what a professional system administrator does. Explain it, what it does and why.
    – peterh
    Oct 30, 2015 at 21:54
  • ran into this with java12 - among other things, this solved my problem....
    – womd
    Apr 4, 2019 at 13:01
-3

i use apache 2.4.9 and adding to the httpd-ssl.conf the following code

SSLProxyProtocol +SSLv3 +TLSv1 +TLSv1.1

i have solved the problems

2
  • 3
    Ever heard of POODLE? SSLv3 should be disabled.
    – Sven
    Dec 13, 2014 at 18:06
  • 3
    SSLv3 is vulnerable
    – insider
    Dec 13, 2014 at 18:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .