I am trying to set up an HTTP reverse proxy to an internal HTTPS server. As a sidenote, yes, I know I am throwing all security away. The original HTTPS server is not sensitive in nature for us, and the product that runs it does not allow turning off HTTPS or reconfiguring the embedded webserver in any way.

I have tried with Nginx, but most people out there seem to be using Apache, so that's what I'm trying now.

This is my current virtual host configuration:

    ServerName server.domain.com

    SSLProxyEngine on
    #SSLProxyMachineCertificateFile /etc/apache2/selfsignedcert.pem
    SSLProxyCACertificateFile /etc/apache2/selfsignedcert.pem

    ProxyRequests Off
    ProxyPass / https://internalserver.internaldomain.com:2941/
    ProxyPassReverse / https://internalserver.internaldomain.com:2941/

        Order Deny,Allow
        Allow from all

    RequestHeader unset Authorization

    ErrorLog /var/log/apache2/internalserver-error.log
    CustomLog /var/log/apache2/internalserver-access.log common


When I try to open http://server.domain.com:10443/ I get the error "401 Unauthorized".

In other ServerFault questions I saw references to UnknownSSLDirectives, but Apache complains that the option doesn't exist. And to using SSLProxyMachineCertificateFile instead of SSLProxyCACertificateFile, but Apache complains that the SSL setup is incomplete in that case.

I am quite stuck. How can I debug this or make some progress? Thank you!

  • What does the error log say? – Jenny D Feb 21 '13 at 7:33
  • Do you mean the error log of Apache or of the HTTPS server? The Apache error log shows no error. I believe the 401 is coming from the HTTPS server. – UrkoM Feb 21 '13 at 7:40
  • I was thinking of your server, but if there's nothing in its error log then I agree that it's likely the problem is with the server you're connecting to. In which case it'd be useful to look at its error logs to see why it doesn't like those connections. – Jenny D Feb 21 '13 at 7:44
  • I'm far from optimistic about getting any useful log out of that server... Do you think I could glean something useful if I use a sniffer on the traffic between Apache and the HTTPS server? – UrkoM Feb 21 '13 at 8:08
  • I'd start by using openssl s_client -connect internalserver.internaldomain.com:2941 to see if you can get access the site then. – Jenny D Feb 21 '13 at 8:27

As of 2018, don't recommend Apache or stunnel for this task. I'd recommend haproxy for its clarity and speed.

As for Apache 2.2, you made mistake with <Proxy>. In a reverse proxy scenario, the access to ProxyPass is controlled with <Location> block, not with <Proxy>.

The <Proxy> applies only to forward proxies and you make a reverse proxy. It's in the manual.

| improve this answer | |

I don't have an answer, but here are some suggestion for debugging the problem.

I'd try to go with "reverse SSL termination" using stunnel in client mode (http://www.thegoldfish.org/2010/01/stunnel-in-client-mode/), and try whether I can connect to http directly via stunnel on a high port (via curl / lynx / tunneling the high port via ssh). At this moment, I deal only with ssl client, and not with Apache's proxy settings.

When I got this working, I'd try to set up plain unencrypted http proxy in Apache to the stunnel port. I got decryption part working, and unencrypted http proxy in Apache is a known and well documented setup. Also, I can use a sniffer (such as tcpdump) to listen on communication between Apache and unencrypted stunnel socket.

Only after this is working, I'd try to figure out how to remove the stunnel middleman and make Apache itself talk https.

Side note: I'd expect some problems with authentication if the backend service sets the secure flag on cookies, and browser believes it's on unencrypted http. Some other headers and redirects may also create problems. In any case, debug the service with curl -v before using browser, and use a Web inspector (such as Firebug) to inspect request/response headers and cookies.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.