I'm working to set up Apache as a forward proxy with a client that uses 2-way SSL. The basic flow is myApplication --via http--> Apache proxy --via 2 way SSL--> client. After setting everything up, when I try to start Apache, I'm getting a "incomplete client cert configured for SSL proxy (missing or encrypted private key?)" error. What I can't figure out is that the client cert I'm using in the SSLProxyMachineCertificateFile directive has both the unencrypted private key and the public cert already. Any suggestions on what I'm missing and/or anything else I can try? Does the all-in-one machine cert need to have the chain in it as well?

Here's what my vhost looks like.

<VirtualHost *:8082>
    ServerName my.domain.com

    ProxyRequests On
    SSLProxyEngine On

    SSLProxyMachineCertificateFile /etc/httpd/keys/machine.pem
    SSLProxyCACertificateFile /etc/httpd/keys/machine.chain.crt

    ProxyPass / https://target.client.com/
    ProxyPassReverse / https://target.client.com/

    <Proxy *>
            Order deny,allow
            Allow from all

EDIT: I updated the basic flow to clarify what kind of connection I'm trying to use between the application, apache, and the client.

  • what is 2-way-SSL? – that guy from over there Oct 15 '13 at 5:21
  • Is the private key in machine.pem DES encrypted (the default when generating)? – Shane Madden Oct 15 '13 at 6:11
  • The all-in-one machine cert should not need to have the chain in it. I would start by trying to connect using without apache, e.g. by doing openssl s_client -connect remoteserver:443 -cert /etc/httpd/keys/machine.pem. The output from that should give you some hint. – Jenny D Oct 15 '13 at 7:48
  • @ShaneMadden I'm going to say yes. When I generated the key and csr it was a pretty standard generation process and I didn't put a password on the private key. – Mike Levy Oct 15 '13 at 14:50
  • @JennyD I tried out your suggestion and was able to successfully connect to the remote server using machine.pem. However, I still can't start Apache when using machine.pem as the SSLProxyMachineCertificateFile. – Mike Levy Oct 15 '13 at 15:04

Your PEM file is not the correct format. Checkout this post.


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.