0

Centos 7, Apache 2.4, TomCat 7.0.52, Java 1.7

I am trying to configure Apache to proxy a tomcat server (running Jira / Confluence) using HTTPS:

(HTTPS:443) -> ApacheServer -> (HTTP:8090 or HTTPS:8091) TomCat

Currently HTTP proxying works perfectly but I want to get HTTPS working. I dont mind if the connection between Apache and Tomcat is SSL (on the same server).

When I visit https://confluence.company.co.uk/ I get /var/www/html/index.html rather than the proxy.

Here is the Server.xml from tomcat:

<Connector port="8090" connectionTimeout="20000" redirectPort="8443"
           maxThreads="200" minSpareThreads="10"
           enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8" />

<Connector port="8091" proxyPort="443" proxyName="confluence.company.co.uk"   acceptCount="100"
           connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false"
           maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" protocol="HTTP/1.1"
           redirectPort="8443" useBodyEncodingForURI="true" scheme="https" secure="true" />

Lines changed from default /etc/httpd/conf.d/ssl.conf from Apache:

ServerName confluence.company.co.uk:443
SSLCertificateFile /etc/pki/tls/certs/company.pem
SSLCertificateKeyFile /etc/pki/tls/private/company.key

Apache VHost Configuration ( in /etc/httpd/conf.d/proxy_vhost.conf ):

<VirtualHost *:80>
    ServerName  confluence.company.co.uk
    ProxyRequests Off
    <Proxy *>
    Order deny,allow
    Deny from all
    Allow from all
    </Proxy>
    <Location />
            AuthType Basic
            AuthName "Proxy Auth"
            AuthUserFile /var/www/company-auth/CONFLUENCE/.htpasswd
            Require user ukuser
            Satisfy any
            Deny from all
            Allow from 192.168.0.0/21
    </Location>
    ProxyPreserveHost On
    ProxyPass / http://confluence.company.co.uk:8090/
    ProxyPassReverse / http://confluence.company.co.uk:8090/
</VirtualHost>
<VirtualHost *:443>
    SSLProxyEngine On
    ProxyRequests Off
    <Proxy *>
    Order deny,allow
    Deny from all
    Allow from all
    </Proxy>
    ProxyPreserveHost On
    ProxyPass / https://confluence.company.co.uk:8091/
    ProxyPassReverse / https://confluence.company.co.uk:8091/
</VirtualHost>
  • do you have name based virtual hosts active? I'd disable them since SNI is still not supported by all browsers, resulting in unexpected host selection for HTTPS. – mihi Jul 22 '15 at 17:50
1

I suggest you to enable AJP connector in both Tomcat and Apache httpd. This binary protocol is dedicated for Java HTTP proxying. Using it may save you configuration time and effort and lower bandwith and resource requirement.

Btw., <Proxy *> directive is irrelevant on reverse proxies.

  • 1
    especially since mod_proxy_ajp is not harder to configure than mod_proxy_http, and you get correct remote ip and other things for free (which requires some trickery with mod_header when you use mod_proxy_http). – mihi Jul 22 '15 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.