I followed this guide: http://hints.macworld.com/article.php?story=20041129143420344

Here is my virtual host definition

<VirtualHost *:443>
    SSLEngine on
    SSLProxyEngine On
    RequestHeader set Front-End-Https "On"
    CacheDisable *
    DocumentRoot "/Users/me/projects/myproject/public"
    ServerName ssl.mydomain.com
    ServerAlias *.ssl.mydomain.com
    SSLCertificateKeyFile "/private/etc/apache2/certs/webserver.nopass.key"
    SSLCertificateFile "/private/etc/apache2/certs/newcert.pem"
    SSLCACertificateFile "/private/etc/apache2/certs/demoCA/cacert.pem"
    SSLCARevocationPath "/private/etc/apache2/certs/demoCA/crl"
    ErrorLog "/Users/me/Desktop/ssl.log"

    ProxyPass / https://localhost:3002/
    ProxyPassReverse / https://localhost:3002
    ProxyPreserveHost on    

And when I try connecting to the sevre viov the web browser, I get this error:

[Thu Feb 02 16:50:40 2012] [error] (502)Unknown error: 502: proxy: pass request body failed to (localhost)
[Thu Feb 02 16:50:40 2012] [error] [client] proxy: Error during SSL Handshake with remote server returned by /session/new
[Thu Feb 02 16:50:40 2012] [error] proxy: pass request body failed to (localhost) from ()

how do I debug / fix this?


To add to vbartoni's answer, it seems that from Apache 2.4 and up, there are different defaults and a new directive.

I am running Apache 2.4.6, and I had to add the following directives to get it working:

SSLProxyEngine on
SSLProxyVerify none 
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
| improve this answer | |
  • 1
    That does the job - only with all those directives its not gonna complain. – Michael Böckling Aug 25 '14 at 17:30
  • @MichaelBöckling Thank you that held me up. I want to point out specifically that the documentation states that SSLProxyCheckPeerName supersedes SSLProxyCheckPeerCN but it won't work unless you specify all of the directives. – dualed Apr 24 '15 at 16:37

Don't bother with HTTPS between your front-end and your back-end server, there's little point in enabling SSL for a localhost connection.

To clarify, use ProxyPass / http://localhost:3002/ instead of ProxyPass / https://localhost:3002/

Alternatively, if you really want to connect your reverse proxy to the back-end server using SSL as well (mostly useful when that server isn't where the Apache Httpd reverse proxy is), in addition to https://backend-server-address, use the SSLProxy* directives to set up the CA certs, as documented in the introduction to the mod_proxy documentation. In particular, you would need to configure SSLProxyCACertificateFile and make sure the certificate of the backend server is issued to the right host name as seen by Apache Httpd (i.e. localhost in your case).

If you're not connecting to your back-end server using SSL, it may fail to detect you're actually using SSL and be configured to force you to go to SSL (hence the infinite redirects). You may want to look at similar mechanisms as what Jetty does with its forwarded option (to be able to tell the back-end it's behind a proxy). Rails might be able to interpret the X-Forwarded-Proto by default. In this case, add this to your Apache config (in the SSL virtual host):

RequestHeader set X-Forwarded-Proto 'https'

There seems to be a similar issue discussed here, for example.

| improve this answer | |
  • SSLProxy is only mentioned once on that link. No examples of how to use it. I changed the request header to be set X-Forwarded-Proto 'https'... but it still doesn't work / I get the same error. Going to localhost:3002 also gives the same error – NullVoxPopuli Feb 6 '12 at 13:26
  • There are valid reasons for connecting to https with localhost: example socket.io in an HTTPS back-end. It will through errors with mixed content. – Florestan06 Jun 17 '15 at 9:45

I had a similar problem (the same error logs), except that the proxy was forwarding https traffic to another host.
Since I was lazy and the hosts are in my own isolated network, these directives solved the problem:

SSLProxyVerify none
SSLProxyCheckPeerCN off

| improve this answer | |

If the backend server uses out-of-date self signed certificate, one more option is needed (if there is no access to the backend server):

SSLProxyCheckPeerExpire off

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.