configs for several sites in apache with ssl

Question

i need to secure two different sites in apache. One of them should only be a proxy for a different server which is running on port 8069.

Now one (which is natively included in apache) runs with SSL:

<VirtualHost *:443>
      ServerName 192.168.1.20
      SSLEngine on
      SSLCertificateFile /etc/ssl/erp/oeserver.crt
      SSLCertificateKeyFile /etc/ssl/erp/oeserver.key
      DocumentRoot /var/www/cloud
      ServerPath /cloud/
      #CustomLog /var/www/logs/ssl-access_log combined
      #ErrorLog /var/www/logs/ssl-error_log
</VirtualHost>

The other one is not running and even not registered. When i try to access it, i get an exception (ssl_error_rx_record_too_long):

<VirtualHost *:443>

ServerName 192.168.1.20
ServerPath /erp/

SSLEngine on
SSLCertificateFile /etc/ssl/erp/oeserver.crt
SSLCertificateKeyFile /etc/ssl/erp/oeserver.key

ProxyRequests Off
ProxyPreserveHost On

<Proxy *>
Order deny,allow
Allow from all
</Proxy>

ProxyVia On
ProxyPass / http://127.0.0.1:8069/
ProxyPassReverse / http://127.0.0.1:8069
RewriteEngine on
RewriteRule ^/(.*) http://127.0.0.1:8069/$1 [P]


RequestHeader set "X-Forwarded-Proto" "https"

SetEnv proxy-nokeepalive 1
</VirtualHost>

My whish is the following configuration:

192.168.1.20        ->> unsecured local path to website
192.168.1.20/cloud/ ->> secured local documentpath from cloud
192.168.1.20/erp/   ->> secured proxy on port 80 for http://192.168.1.20:8069

how is this possible? is this even possible? perhaps cloud.192.168.1.20 and erp.192.168.1.20 is better?!

Thank you ============ EDIT ========================== apache2ctl -S -M: *:443 is a NameVirtualHost default server myserver (/etc/apache2/conf.d/cloud.conf:1) port 443 namevhost myserver (/etc/apache2/conf.d/cloud.conf:1) *:80 is a NameVirtualHost default server myserver (/etc/apache2/sites-enabled/default:1) port 80 namevhost myserver (/etc/apache2/sites-enabled/default:1)

default:

<VirtualHost *:80>
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

    ServerAdmin webmaster@localhost

    DocumentRoot /var/www
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Modified (current) cloud.conf:

<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile /etc/ssl/openerp/oeserver.crt
    SSLCertificateKeyFile /etc/ssl/openerp/oeserver.key
    DocumentRoot /var/www/
    RewriteCond {REQUEST_URI} ^/cloud$
    RewriteEngine on
    RewriteRule /(.*) http://127.0.0.1:8069/$1 [P]
    RequestHeader set "X-Forwarded-Proto" "https"
    SetEnv proxy-nokeepalive 1
</VirtualHost>

Answer 1

you cannot have

<VirtualHost *:443>
      ServerName 192.168.1.20
      SSLEngine on

2 times because apache will bind to one virtualhost only.

why not include both /locations/ into one config?

<VirtualHost *:443>
      ServerName 192.168.1.20
      SSLEngine on
      SSLCertificateFile /etc/ssl/erp/oeserver.crt
      SSLCertificateKeyFile /etc/ssl/erp/oeserver.key
      DocumentRoot /var/www/cloud
      <Directory /var/www/cloud>
          blah
      </Directory>

      # erp-config
      # ... proxy_config ....
      ProxyPass /erp http://127.0.0.1:8069/
      proxyPassReverse /erp http://127.0.0.1:8069/

</VirtualHost>

---

Edit2

another way would be 2 separate <VirtualHosts> - configs, either Name-Based (one IP, SNI must be available) or IP-Based (one IP for each host, works usually always)