1

I have a web server (Apache reverse proxy) in front of my app server (Apache) and I'm trying to pass common name for SSL.

My web server (Apache reverse proxy) is setup to preserve hostname (ProxyPreserveHost On)

On my app server (Apache) how do I configure my virtual host to pickup on on the hostname passed by the Proxy server?

I'm getting errors like this:

[warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[warn] RSA server certificate CommonName (CN) `appserver01' does NOT match server name!?

Do I need anything additional turned via on my app server (Apache configuration)? Here is what my vhost looks like:

NameVirtualHost *:80
Header always append X-Frame-Options SAMEORIGIN

<VirtualHost *:80>
    DocumentRoot /var/www/app
    ServerName www.app.com
    ServerAlias app.com
    ServerAlias appserver01.domain.com

    <Directory /var/www/app>
        Options All
        AllowOverride All
    </Directory>

</VirtualHost>

<VirtualHost IP_OF_WEB_SERVER_HERE:443>
    DocumentRoot /var/www/app
    ServerName www.app.com
    ServerAlias app.com
    ServerAlias appserver01.domain.com

    <Directory /var/www/app>
        AllowOverride All
    </Directory>

    SSLProxyEngine On
    SSLEngine On
    SSLCertificateFile    /etc/ssl/certs/www_app_com_cert.cer
    SSLCertificateKeyFile /etc/ssl/certs/www_app_com.key
    SSLCACertificateFile /etc/ssl/certs/ca-bundle.crt

</VirtualHost>

Basically I want to allow the hostname to pass through the proxy server so my SSL cert will work. I have ProxyPreserveHost turned on but it doesn't appear to work as the Apache webserver still sees the hostname as the internal hostname "appserver01" instead of "www.app.com".

Thanks

2
  • If you have control on the channel between the proxy and your server, in your place I transformed the https to http.
    – peterh
    Jan 13, 2015 at 12:11
  • The warnings in your log files are quite ignorable and normal even on well-configured servers. It is just making the (very commonly false) assumption that just because the canonical hostname of the host might be "appserver1", then your clients would be accessing it as appserver1... Apr 18, 2015 at 9:52

1 Answer 1

-1

Try enabling the SSL Proxy Engine:

SSLProxyEngine On
1
  • I tried that and I see the same error in my ssl_error log file. Aug 4, 2014 at 12:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.