I wish to set up a new website that will be accessed by users using HTTPS. I think it is good practise to put the "real" web server in a seperate subnet, and then install an Apache Reverse Proxy in a DMZ.

My question is, where should I put the SSL cert(s)? Should I

a) Use a self-signed cert on the "real" web server, and a proper cert on the reverse proxy?

b) Use 2 real certs on both the "real" web server and the reverse proxy?

c) Don't use any cert on the "real" web server, and use a proper cert on the reverse proxy?

I'd like to use a) or c), if possible. I also don't want anyone's browser complaining of a self-signed cert.


2 Answers 2


have look this link ssl

  • Thanks, but I already know how to set up a standalone SSL Apache server. What I'm asking is the layout of the infrastructure, and where to encrypt connections
    – jtnire
    Aug 3, 2010 at 15:55
  • host-to-host IPsec connection
    – Rajat
    Aug 4, 2010 at 16:35

Typically, Web servers would go in the DMZ unless for an unusual reason they contain restricted or confidential information. Databases typically contain that data, which go in a more restricted subnet.

Often, modern DMZs are an internally reserved subnet. You would have a firewall on the edge network, which would provide NATing to that subnet. What I describe is a dual firewall configuration.

SSL certificates would be acceptable on the network segment where the Web servers live. I typically lean towards encryption whenever reasonably possible unless there's another consideration at the time. I would use a CA signed SSL certificate in all cases that you describe.

  • So what should I do? Forego the Apache reverse proxy and just have a single Apache SSL web server in my DMZ, and put my DB server in a seperate subnet, and only allow the MYSQL port from webserver to DB server subnet?
    – jtnire
    Aug 3, 2010 at 15:54
  • I'd recommend that over your existing proposal. You could still use the reverse proxy but the main benefits would be caching and abstracting, which enables URL re-writing. Potentially load balancing depending on the proxy but I consider that outside of the reverse proxy role.
    – Warner
    Aug 3, 2010 at 16:02
  • Warner, can you please explain the benefit of placing the DB in a seperate subnet? As if the DMZ Webserver was compramised, woudn't the MYSQL credentials be available to the attacker? Thanks
    – jtnire
    Aug 3, 2010 at 16:04
  • Also, a benefit of using a reverse proxy would be so that I could install ModSecurity (WAF). My current train of though is to put reverse proxy in the DMZ, and to put the "real" webserver and DB server in a sepereate subnet. However, since this whole setup will be on Xen, I can use iptable to filter between webserver and db server, even though they are on same subnet. How does that sound?
    – jtnire
    Aug 3, 2010 at 16:11
  • Separating the db reduces the footprint, as you can substantially lessen accessibility. It is an additional step that would be necessary for a complete compromise.
    – Warner
    Aug 3, 2010 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.