0

this is my first technical question in a non native language, so i'll try to be clear as much as possible.

We need to deploy a Tomcat behind a F5 in a customer environment. The F5 basically translates packets from HTTPS to HTTP and send them unencrypted to the backend server. That process should be known as "offload SSL".

As default, in our tomcats installation method we mostly deploy a reverse proxy (Apache httpd on Windows) between the firewall that faces internet and the Tomcat.

Our default scheme would be like this:

Client <--https/http--> Firewall <-NAT-> port 443/80 Apache <--AJP--> port 8009 Tomcat

This is the scheme for this new offloading situation:

Client <--https/http--> Firewall/F5 <--HTTP--> port 80 Apache <--AJP--> port 8009 Tomcat

So what's the problem? Our customer reports this results when trying to reach on the browser the webapp page on port 8080 (without passing through Apache on port 80) using HTTP (already translated from HTTPS on the F5 side):

Bad Request

Your browser sent a request that this server could not understand. Reason: You're speaking plain HTTP to an SSL-enabled server port. Instead use the HTTPS scheme to access this URL, please

Instead when they try to reach Apache on port 80 it gives them a blank page. They also tried to use HTTPS without offload for the sole testing purpose on port 443 of Apache and it works fine (I've put a self-signed certificate on Apache port 443), so the problem appears only with the offloading enabled on F5.

This is their F5 configuration:

when HTTP_REQUEST {

 # Remove untrusted HTTP X-Forwarded headers
 # from HTTP requests and set our own:
 #
 # - X-Forwarded-For
 # - X-Forwarded-Host
 # - X-Forwarded-Port
 # - X-Forwarded-Proto
 # - X-Real-IP
 #
 
 #  X-Forwarded headers clean-up
 #
 HTTP::header remove X-Forwarded-For
 HTTP::header remove X-Forwarded-Host
 HTTP::header remove X-Forwarded-Port
 HTTP::header remove X-Forwarded-Proto
 HTTP::header remove X-Real-IP
 
 # Set our own X-Forwarded and X-Real-IP headers
 
 # X-FORWARDED-FOR and X-REAL-IP
 #
 HTTP::header insert X-Forwarded-For [IP::client_addr]
 HTTP::header insert X-Real-IP [IP::client_addr]
 
 # X-FORWARDED-HOST
 #
 if { [HTTP::host] ne "" } {
 HTTP::header insert X-Forwarded-Host [HTTP::host]
 } else {
     HTTP::header insert X-Forwarded-Host [clientside {IP::local_addr}]
 }
 
 # X-FORWARDED-PORT
 #
 HTTP::header insert X-Forwarded-Port [TCP::local_port]
 
 # X-FORWARDED-PROTO
 #
 if { [PROFILE::exists clientssl] == 1 } {
 HTTP::header insert X-Forwarded-Proto "https"
 } else {
 HTTP::header insert X-Forwarded-Proto "http"
 }
}

Can anyone help me get this straight please? I can't find a proper configuration for Apache to handle this situation as a proxy server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy