I am using an apache (2.4) server configured as loadbalancer in front of 2 apache servers. It works fine when I use http connections between loadbalancer and backends, however using https does not work. The configuration of the loadbalancer:
SSLProxyEngine on SSLProxyVerify none SSLProxyCheckPeerCN off <Proxy balancer://testcluster> BalancerMember https://[Backend1]:443/test BalancerMember https://[Backend2]:443/test </Proxy> ProxyPass /test balancer://testcluster
The backends only have self-signed certificates for now which is why the certificate verification is disabled.
The error-log on the loadbalancer contains the following:
[proxy:error] [pid 31202:tid 140325875570432] (502)Unknown error 502: [client ...] AH01084: pass request body failed to [Backend1]:443 ([Backend1]) [proxy:error] [pid 31202:tid 140325875570432] [client ...] AH00898: Error during SSL Handshake with remote server returned by /test/test.jsp [proxy_http:error] [pid 31202:tid 140325875570432] [client ...] AH01097: pass request body failed to [Backend1]:443 ([Backend1]) from [...] ()
The error-page in the browser contains:
Proxy Error The proxy server could not handle the request GET /test/test.jsp. Reason: Error during SSL Handshake with remote server
As I already stated above changing the configuration to the http protocol and port 80 works. Also https connections between the client and loadbalancer work, so the ssl module of the loadbalancer seems to be setup properly. Connecting directly to the backend via https also does not yield any errors.
Thanks in advance for your time
Edit: I figured it out, the problem is that my certificates common name does not match the server name. I thought SSLProxyVerify none would cause this mismatch to be ignored, but it doesn't. Prior to apache 2.4.5 this check can be disabled using SSLProxyCheckPeerCN off but on higher versions (I am using 2.4.7) SSLProxyCheckPeerName off also needs to be specified.
The working configuration looks like this:
SSLProxyEngine on SSLProxyVerify none SSLProxyCheckPeerCN off SSLProxyCheckPeerName off <Proxy balancer://testcluster> BalancerMember https://[backend1]:443/test BalancerMember https://[backend1]:443/test </Proxy> ProxyPass /test balancer://testcluster
Unfortunately I can't answer my own question for lack of reputation so I edited my question, I hope this helps anyone who encounters a similar problem