1

I don't want my clients to negotiate an SSL connection with Apache web server, I want them to do so with the tomcat server behind it instead. How can I do so?

My current httpd.conf configuration is:

Listen 443 https
SSLProxyEngine On
ProxyPass / https://localhost:8443/
ProxyPassReverse / https://localhost:8443/
<VirtualHost _default_:443>
  SSLProxyEngine On
  ProxyPass / https://localhost:8443/
  ProxyPassReverse / https://localhost:8443/
  SSLEngine On
  SSLProtocol all -SSLv2
  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA
  SSLCertificateFile /etc/pki/tls/certs/localhost.crt
  SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
</VirtualHost>

It works, but not as I want. It seems the client is negotiating with apache, and apache web server with tomcat. (What I see is the apache web server self signed certificate)

1
  • 2
    You can't have both Apache and Tomcat using the default HTTPS port for starters, so disable HTTPS in Apache first, then reconfigure Tomcat to use port 443 in your SSL connector (or use a slightly more advanced iptables redirect if you don't want to run Tomcat on a privileged port) – HBruijn Dec 31 '15 at 13:49
1

I don't think that you can do what you want with apache in front of tomcat. If you want tomcat to handle the ssl negotiation why not just use iptables to redirect traffic on 443 to its port (8443)? You could do that with a rule like (replace eth0 with your ethernet interface):

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8443

If you want/need to keep apache in place I think you will need to negotiate ssl in apache. As an alternative if you want something in front of your tomcat app you could use haproxy or nginx - they will work as generic proxies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.