1

I am working on our Debian X64 server which is the endpoint for 5 domain-names. One of the domain-names is utilized by a web-project running on Apache web server. The remaining 4 domains have individual webapps running on a single instance of Apache Tomcat. Currently I am using mod_proxy for redirecting requests to appropriate webapps.

Unfortunately, this setup becomes useless as soon as HTTPS comes into picture. I am unable to install a single https certificate which has all the domains in it. Such a certificate is provided by LetsEncrypt.

After installing the certificate, any request would be redirected only to a single Tomcat domain. At first I couldn't understand this behaviour, but after checking the certificate I saw that the domain it was redirecting to was the first in the multiple domains in certificate. I don't know why the URL is not processed, but that's the current behaviour. I was thinking about using mod_jk instead of mod_proxy for this task, but don't know if that's exactly what I require.

I would like to know how I can create a setup, where I can install individual SSL certificates for each domain. Here is a basic overview how the setup is currently :

enter image description here

Apache2 workers.properties :

 worker.list = worker_app1
worker.worker_app1.type = lb
worker.worker_app1.balance_workers = app1_instance1
worker.worker_app1.sticky_session = true
worker.worker_app1.sticky_session_force = false
worker.worker_app1.method = busyness

worker.app1_instance1.type = ajp13
worker.app1_instance1.host = 127.0.0.1
worker.app1_instance1.port = 8010
worker.app1_instance1.host = localhost
worker.app1_instance1.lbfactor = 1
worker.app1_instance1.socket_timeout = 40
worker.app1_instance1.socket_keepalive = true
worker.app1_instance1.reply_timeout = 30000

Apache sites-enabled/000-default :

<VirtualHost *:80>
        ServerAdmin webmaster@localhost
        ServerName www.domain4.de.com
        ServerAlias domain4.de.com
        DocumentRoot /var/www
        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
        <Directory /var/www/>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride All
                 Order allow,deny
                allow from all
        </Directory>

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Listen 443
<VirtualHost *:443>
ServerName www.domain1.de
ServerAlias domain1.de
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/www.domain1.de/tool.crt
SSLCertificateKeyFile /etc/letsencrypt/live/www.domain1.de/private.key
ProxyRequests off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
#ErrorDocument 503 /maintenance.html
# ErrorDocument 404 /maintenance.html
# ErrorDocument 500 /maintenance.html

#ProxyPass /maintenance.html !
#ProxyPass / http://localhost:8080/
#ProxyPassReverse / http://localhost:8080/

<Location / >
Order allow,deny
Allow from all
</Location>
</VirtualHost>

<VirtualHost *:80>
ServerName www.domain3.de
ServerAlias domain3.de
ProxyRequests off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
#ErrorDocument 503 /maintenance.html
# ErrorDocument 404 /maintenance.html
# ErrorDocument 500 /maintenance.html

#ProxyPass /maintenance.html !
#ProxyPass / http://localhost:8080/
#ProxyPassReverse / http://localhost:8080/

<Location / >
Order allow,deny
Allow from all
</Location>
</VirtualHost>


<VirtualHost *:80>
ServerName www.domain3.de
ServerAlias domain3.de
ProxyRequests off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ErrorDocument 503 /maintenance.html
 ErrorDocument 404 /maintenance.html
 ErrorDocument 500 /maintenance.html

ProxyPass /maintenance.html !

ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/

<Location / >
Order allow,deny
Allow from all
</Location>
</VirtualHost>

<VirtualHost *:80>
ServerName www.domain2.de
ServerAlias domain2.de
ProxyRequests off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>

ErrorDocument 503 /maintenance.html
 ErrorDocument 404 /maintenance.html
 ErrorDocument 500 /maintenance.html

ProxyPass /maintenance.html !

ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/

<Location / >
Order allow,deny
Allow from all
</Location>
</VirtualHost>

<VirtualHost *:80>
ServerName www.domain5.de
ServerAlias domain5.de
ProxyRequests off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>

ErrorDocument 503 /maintenance.html
 ErrorDocument 404 /maintenance.html
 ErrorDocument 500 /maintenance.html

ProxyPass /maintenance.html !

ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/

<Location / >
Order allow,deny
Allow from all
</Location>
</VirtualHost>

If there is any other information required, kindly let me know. Thank you for your time.

Edit

I redeployed all the webapps to work with https by specifying in Spring-security config. And I tried the config below. please note for each VirtualHost I also tried ProxyPass with localhost:8080 . Currently, only the webserver app loads, nothing else.

I changed the 000-default as follows :

<VirtualHost *:80>
        ServerAdmin webmaster@localhost
        ServerName www.domain4.de.com
        ServerAlias domain4.de.com
        DocumentRoot /var/www
        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
        <Directory /var/www/>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride All
                 Order allow,deny
                allow from all
        </Directory>

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Listen 443
<VirtualHost *:443>
ServerName www.domain1.de
ServerAlias domain1.de
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/www.domain1.de/tool.crt
SSLCertificateKeyFile /etc/letsencrypt/live/www.domain1.de/private.key
ProxyRequests off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
#ErrorDocument 503 /maintenance.html
# ErrorDocument 404 /maintenance.html
# ErrorDocument 500 /maintenance.html

#ProxyPass /maintenance.html !
#ProxyPass / http://localhost:8443/
#ProxyPassReverse / http://localhost:8443/

<Location / >
Order allow,deny
Allow from all
</Location>
</VirtualHost>

<VirtualHost *:443>
ServerName www.domain3.de
ServerAlias domain3.de
ProxyRequests off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
#ErrorDocument 503 /maintenance.html
# ErrorDocument 404 /maintenance.html
# ErrorDocument 500 /maintenance.html

#ProxyPass /maintenance.html !
#ProxyPass / http://localhost:8443/
#ProxyPassReverse / http://localhost:8443/

<Location / >
Order allow,deny
Allow from all
</Location>
</VirtualHost>


<VirtualHost *:443>
ServerName www.domain3.de
ServerAlias domain3.de
ProxyRequests off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ErrorDocument 503 /maintenance.html
 ErrorDocument 404 /maintenance.html
 ErrorDocument 500 /maintenance.html

ProxyPass /maintenance.html !

ProxyPass / http://localhost:8443/
ProxyPassReverse / http://localhost:8443/

<Location / >
Order allow,deny
Allow from all
</Location>
</VirtualHost>

<VirtualHost *:443>
ServerName www.domain2.de
ServerAlias domain2.de
ProxyRequests off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>

ErrorDocument 503 /maintenance.html
 ErrorDocument 404 /maintenance.html
 ErrorDocument 500 /maintenance.html

ProxyPass /maintenance.html !

ProxyPass / http://localhost:8443/
ProxyPassReverse / http://localhost:8443/

<Location / >
Order allow,deny
Allow from all
</Location>
</VirtualHost>

<VirtualHost *:443>
ServerName www.domain5.de
ServerAlias domain5.de
ProxyRequests off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>

ErrorDocument 503 /maintenance.html
 ErrorDocument 404 /maintenance.html
 ErrorDocument 500 /maintenance.html

ProxyPass /maintenance.html !

ProxyPass / http://localhost:8443/
ProxyPassReverse / http://localhost:8443/

<Location / >
Order allow,deny
Allow from all
</Location>
</VirtualHost>
  • You don't need separate certs if you have valid multi-name (SAN) cert as Letsencrypt does. You need a VirtualHost block on 443 for each domain you want Apache to support in HTTPS; you only have one, so Apache is by default using that one for all HTTPS requests. – dave_thompson_085 Apr 15 '16 at 9:24
  • @dave_thompson_085 : Do you mean, I have to just create virtualhost with 443 on each domain and add the subsequent SSL certificate like I have added for one block and that should be enough? – We are Borg Apr 15 '16 at 9:27
  • @dave_thompson_085 : I made the changes as you suggested, but it only made the other webapps also load the webserver project. I have added the configuration in the post in Edit. Can you kindly check and reply. Thank you. – We are Borg Apr 15 '16 at 12:10
  • You now have one vhost on 80(http) for domain4 with some content, and vhosts on 443(https) for domain[325] that proxy to http localhost:8443, plus for domain1 with apparently no content -- I'm not sure what Apache does for that. Do all http-no-s requests get the domain4 content? Are you sure your Tomcat handles http-no-s on 8443? That's possible but very unusual. If not, https requests to your proxied domains won't work, and should get an error; my system gets a 503 but you've masked that on your system. – dave_thompson_085 Apr 22 '16 at 7:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.