2

I'm working to set up Apache as a forward proxy with a client that uses 2-way SSL. The basic flow is myApplication --via http--> Apache proxy --via 2 way SSL--> client. After setting everything up, when I try to start Apache, I'm getting a "incomplete client cert configured for SSL proxy (missing or encrypted private key?)" error. What I can't figure out is that the client cert I'm using in the SSLProxyMachineCertificateFile directive has both the unencrypted private key and the public cert already. Any suggestions on what I'm missing and/or anything else I can try? Does the all-in-one machine cert need to have the chain in it as well?

Here's what my vhost looks like.

<VirtualHost *:8082>
    ServerName my.domain.com

    ProxyRequests On
    SSLProxyEngine On

    SSLProxyMachineCertificateFile /etc/httpd/keys/machine.pem
    SSLProxyCACertificateFile /etc/httpd/keys/machine.chain.crt

    ProxyPass / https://target.client.com/
    ProxyPassReverse / https://target.client.com/

    <Proxy *>
            Order deny,allow
            Allow from all
    </Proxy>
</VirtualHost>

EDIT: I updated the basic flow to clarify what kind of connection I'm trying to use between the application, apache, and the client.

Improve this question
8
  • what is 2-way-SSL?
    – that guy from over there
    Commented Oct 15, 2013 at 5:21
  • Is the private key in machine.pem DES encrypted (the default when generating)?
    – Shane Madden
    Commented Oct 15, 2013 at 6:11
  • The all-in-one machine cert should not need to have the chain in it. I would start by trying to connect using without apache, e.g. by doing openssl s_client -connect remoteserver:443 -cert /etc/httpd/keys/machine.pem. The output from that should give you some hint.
    – Jenny D
    Commented Oct 15, 2013 at 7:48
  • @ShaneMadden I'm going to say yes. When I generated the key and csr it was a pretty standard generation process and I didn't put a password on the private key.
    – Mike Levy
    Commented Oct 15, 2013 at 14:50
  • @JennyD I tried out your suggestion and was able to successfully connect to the remote server using machine.pem. However, I still can't start Apache when using machine.pem as the SSLProxyMachineCertificateFile.
    – Mike Levy
    Commented Oct 15, 2013 at 15:04

1 Answer 1

Reset to default
0

Your PEM file is not the correct format. Checkout this post.

http://projectzme.wordpress.com/2013/02/02/tip-sslproxymachinecertificatefile-returns-missing-or-encrypted-private-key/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .