SSL and ProxyPass

Question

js server running on 8200 and I just got some SSL certificates for my domain. I want to be able to serve my page over HTTPS.

So far my apache config file is like so

File: /etc/apache2/sites-enabled/synsis.conf

<VirtualHost *:443>
  ServerAdmin [email protected]
  ServerName  www.synsis.live
  ServerAlias synsis.live

  SSLEngine On
  SSLProxyEngine On
  SSLCertificateFile "/home/vas/synsis.live/certs/domain.crt"
  SSLCertificateKeyFile "/home/vas/synsis.live/certs/domain.key"
  SSLCertificateChainFile "/home/vas/synsis.live/certs/intermediate.pem"


  ProxyRequests Off
  <Proxy *>
    Order deny,allow
    Allow from all
  </Proxy>

<Location />
  ProxyPass  https://localhost:8200/
  ProxyPassReverse  https://localhost:8200/
</Location>
</VirtualHost>

However, my site does not load using this config. Any ideas?

apachectl -t

AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
Syntax OK

and apachectl -S

VirtualHost configuration:
*:80                   is a NameVirtualHost
         default server 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:1)
         port 80 namevhost 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:1)
         port 80 namevhost ch.mu (/etc/apache2/sites-enabled/c.conf:1)
         port 80 namevhost www.hai.run (/etc/apache2/sites-enabled/hai.conf:3)
                 alias hai.run
         port 80 namevhost practicalhuman.org (/etc/apache2/sites-enabled/ph.conf:4)
                 alias www.practicalhuman.org
*:443                  www.synthesis.live (/etc/apache2/sites-enabled/synthesis.conf:5)

ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex ssl-stapling: using_defaults
Mutex proxy: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/lock/apache2" mechanism=fcntl
Mutex mpm-accept: using_defaults
Mutex watchdog-callback: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="www-data" id=33 not_used
Group: name="www-data" id=33 not_used

Answer 1

You configuration contains three of my major gripes about configuration examples out there in the wild

1. The use of <Proxy *> blocks when configuring an reverse proxy. <Proxy> blocks are almost exclusively used to configure forward proxies not reverse. In your case it is not needed.
2. The use of ProxyPass inside location blocks. Best practise is to use the 2 argument version of ProxyPass unless there is no alternative.
3. Use of Apache v2.2 authorisation directives in Apache v2.4. I would strongly recommend always changing all your v2.2 Allow, Order, Satisfy and require directives to the new v2.4 Require directive and <RequireAny> and <RequireAll> blocks.
4. The SSLProxyEngine directive is used to configure your server when you are proxying to and SSL based service and has nothing to do with whether your actual virtual host is an SSL one or not (Yes I know I said 3, but this is a very minor one, and I only added it because you replied saying your back-end was not SSL enabled :-)

Try the following as a base, and hopefully "clean", configuration and work from there. *f it doesn't work, tell us what actually happens rather than just saying "it doesn't work".

<VirtualHost *:443>
  ServerAdmin [email protected]
  ServerName  www.synsis.live
  ServerAlias synsis.live

  SSLEngine On
  SSLProxyEngine On
  SSLCertificateFile "/home/vas/synsis.live/certs/domain.crt"
  SSLCertificateKeyFile "/home/vas/synsis.live/certs/domain.key"
  SSLCertificateChainFile "/home/vas/synsis.live/certs/intermediate.pem"

  # This is the default anyway, but no harm having it explicitly set
  ProxyRequests Off

  # You say in a comment your backend is not SSL, but your original configuration
  # tries to proxy to an SSL enabled service. This is almost certainly
  # why it originally failed
  ProxyPass / http://localhost:8200/
  ProxyPassReverse / http://localhost:8200/
</VirtualHost>

Answer 2

is your backend ssl?

if not:

<VirtualHost *:443>
  ServerAdmin [email protected]
  ServerName  www.synsis.live
  ServerAlias synsis.live

  SSLEngine On
  SSLProxyEngine On
  SSLCertificateFile "/home/vas/synsis.live/certs/domain.crt"
  SSLCertificateKeyFile "/home/vas/synsis.live/certs/domain.key"
  SSLCertificateChainFile "/home/vas/synsis.live/certs/intermediate.pem"


  ProxyRequests Off
  <Proxy *>
    Order deny,allow
    Allow from all
  </Proxy>

<Location />
  ProxyPass  http://localhost:8200/
  ProxyPassReverse  http://localhost:8200/
</Location>
</VirtualHost>

if it is:

<VirtualHost *:443>
  ServerAdmin [email protected]
  ServerName  www.synsis.live
  ServerAlias synsis.live

  SSLEngine On
  SSLProxyEngine On
  SSLCertificateFile "/home/vas/synsis.live/certs/domain.crt"
  SSLCertificateKeyFile "/home/vas/synsis.live/certs/domain.key"
  SSLCertificateChainFile "/home/vas/synsis.live/certs/intermediate.pem"


  ProxyRequests Off
  <Proxy *>
    Order deny,allow
    Allow from all
  </Proxy>

<Location />
  SSLProxyEngine on
  ProxyPass  https://localhost:8200/
  ProxyPassReverse  https://localhost:8200/
</Location>
</VirtualHost>