2

I would like to have an Apache 2.4 proxy which redirects port 80 and 443 requests to different machines in the local network, depending on the host name. I used mod_proxy and it works fine with port 80.

Now I am trying to do a HTTPS->HTTPS redirect. Following code works:

<VirtualHost *:443>
    ServerName domain.tld
    ServerAlias www.domain.tld

    SSLProxyEngine On
    ProxyPass / https://new.domain.tld/
    ProxyPassReverse / https://new.domain.tld/

    SSLEngine on
    SSLCertificateFile /etc/myssl/public.pem
    SSLCertificateKeyFile /etc/myssl/privkey.pem
    SSLCertificateChainFile /etc/myssl/chain-class2.pem
</VirtualHost>

The problem is that the proxy needs to have all the SSL keyfiles of the machines, which produces a lot of overhead in the yearly certificate renewal.

I do understand that the proxy needs to establish an encrypted connection using its own key material to inspect the Host: HTTP-header to find out which VirtualHost to use.

But since today's browsers usually implement SNI, I would like to use this information to delegate to the correct VirtualHost without requiring any key material at the proxy. Is this possible in Apache 2.4?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.