bypass apache SSL and use tomcat instead

Question

I don't want my clients to negotiate an SSL connection with Apache web server, I want them to do so with the tomcat server behind it instead. How can I do so?

My current httpd.conf configuration is:

Listen 443 https
SSLProxyEngine On
ProxyPass / https://localhost:8443/
ProxyPassReverse / https://localhost:8443/
<VirtualHost _default_:443>
  SSLProxyEngine On
  ProxyPass / https://localhost:8443/
  ProxyPassReverse / https://localhost:8443/
  SSLEngine On
  SSLProtocol all -SSLv2
  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA
  SSLCertificateFile /etc/pki/tls/certs/localhost.crt
  SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
</VirtualHost>

It works, but not as I want. It seems the client is negotiating with apache, and apache web server with tomcat. (What I see is the apache web server self signed certificate)

Answer 1

I don't think that you can do what you want with apache in front of tomcat. If you want tomcat to handle the ssl negotiation why not just use iptables to redirect traffic on 443 to its port (8443)? You could do that with a rule like (replace eth0 with your ethernet interface):

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8443

If you want/need to keep apache in place I think you will need to negotiate ssl in apache. As an alternative if you want something in front of your tomcat app you could use haproxy or nginx - they will work as generic proxies.