0

I have Apache and a custom non-Apache web service running on the same server. I'm trying to get Apache to reverse-proxy SSL connections to the other site on to prevent SSL warnings from showing up when someone reaches my site by entering the address into their browser (https://xx.xx.xx.xx). I'd want the request gets changed automatically to a FQDN request under those circumstances to prevent certificate warnings.

My site is running on a custom service (not Apache) and it doesn't have the ability to stop this. My plan is to set up Apache to listen on 443 and to redirect to port 80 on the same box and use some sort of rewrite rule to prevent the direct IP access, or redirect it.

I can get that part working okay but requests direct to the IP aren't automatically redirected to requests for the name. The partly working test config on port 8080 is below.

<VirtualHost *:8080>
ServerName fqdn
SSLEngine On
SSLCertificateFile /etc/httpd/ssl/Cert.crt
SSLCertificateKeyFile /etc/httpd/ssl/Key.key
SSLCertificateChainFile /etc/httpd/ssl/TrustedRoot.crt
ProxyRequests Off
ProxyPreserveHost On
<Proxy *>
AddDefaultCharset Off
Order deny,allow
Allow from all
</Proxy>
ProxyPass / http://fqdn:80/
ProxyPassReverse / http://fqdn:80/

ErrorLog logs/myserver-error_log
CustomLog logs/myserver-access_log common
</VirtualHost>

I've tried some rewrite directives but haven't had much success. Also javascript redirects won't prevent the SSL errors. Ideas?

2
  • If your service is listening on *:80, then Apache will never receive a http request, to there'll never be anyting to rewrite. Mar 19, 2018 at 18:44
  • If one wants to avoid getting TLS certificate errors when connecting to an IP address with https, one needs to have a proper certificate which is valid for the IP address. Mar 19, 2018 at 18:54

1 Answer 1

0

Change your service to listen on a port that can't be reached from the outside, say 8888. Apache should handle every incoming request, sending a redirect (rewrite) for those that don't please you. Those that satisfy, eg. the FQDN:

ProxyPass / http://127.0.0.1:8888/
ProxyPassReverse / http://127.0.0.1:8888/

Add a virtualhost on port 443 for the secure requests (https/SSL) and a default server for those request that come to your system without using the FQDN.

1
  • Thank you for this. Everything you described makes sense but how would I do those last couple of steps? All of the directives I showed above come from the " default-site.conf" file. Mar 19, 2018 at 20:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .