2

I've a frontal server with Apache 2.4.23 deployed + OpenSSL 1.0.2j.

Then I've another server with Tomcat 7 installed.

The idea is that Apache has a VHOST on *:443, which uses ProxyPass to send the request via AJP to Tomcat server according to specifyc URLs.

That's my vhosts.conf file (it has SSL configuration as I don't want to use the httpd-ssl.conf file, cause I've to change many things on it), according to this site:

https://mozilla.github.io/server-side-tls/ssl-config-generator/

##################################################################################################################
# VHOSTS HTTP

# redirect all HTTP to HTTPS (optional)
<VirtualHost *:80>

    ServerAlias *
    RewriteEngine On
    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [redirect=301]

</VirtualHost>

##################################################################################################################
# VHOSTS HTTPS

Listen 443

# modern configuration, tweak to your needs
SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLProxyProtocol        all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
SSLProxyCipherSuite     ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
SSLHonorCipherOrder     on
SSLCompression          off
SSLSessionTickets       off

SSLPassPhraseDialog     builtin

SSLSessionCache        "shmcb:c:/ap24/logs/ssl_scache(512000)"
SSLSessionCacheTimeout  300

# OCSP Stapling, only in httpd 2.3.3 and later
SSLUseStapling                      on
SSLStaplingResponderTimeout         5
SSLStaplingReturnResponderErrors    off
SSLStaplingCache                    "shmcb:c:/ap24/logs/ocsp(128000)"

<VirtualHost *:443>

    SSLEngine on
    SSLCertificateFile "conf/xin.foo.com/xin.crt"
    SSLCertificateChainFile "conf/xin.foo.com/bundle.crt"
    SSLCertificateKeyFile "conf/xin.foo.com/xin.key"

    # Uncomment the following directive when using client certificate authentication
    #SSLCACertificateFile    /path/to/ca_certs_for_client_authentication

    # HSTS (mod_headers is required) (15768000 seconds = 6 months)
    Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"

    ProxyRequests Off
    ProxyPreserveHost On

    ProxyPass /bar ajp://X.X.X.X:XXXX/bar/
    ProxyPass /bar/ ajp://X.X.X.X:XXXX/bar/bar.html

</VirtualHost>

Now as you can see, I've 2 proxypasses according to how URL is. That's because I've and "admin"/backend zone, and a user zone. First proxypass is per Admin Zone, and second one to User zone.

Now, for those sites I need those URLS:

ADMIN: https://xin.foo.com/bar/bar

USER: https://xin.foo.com/bar/bar?app=personal

I'm using Apache server on a "local" context right now, which means I have not a TLD subdomain already with the Apache server public IP on it. So, on my local machine in the office, I've edited my "hosts" file on "windows/system32/drivers/etc" and added the line:

xin.foo.com Y.Y.Y.Y (which is the IP address of the Apache frontal server). This way I can emulate from my machine, what a public acces from inet will be.

Said all that, now comes the thing:

Inet people, will access thorugh https://xin.foo.com. That's it.

I want "https://xin.foo.com" to access directly to USER zone.

And something like https://xin.foo.com/admin, to access to ADMIN backend zone.

Then, here I guess are 2 things to take in account:

  • AJP proxypasses
  • Possibility of mod-rewrite'ing first with parametters or something, to force the already configured proxypasses to work? As tha aplication mounted on Tomcat server, expects some parameters (?app=personal) to show user zone. And no params = admin zone.

Maybe I've to delete the Proxypasses and do some mod_proxy_ajp to it?

What will be the right way to do it and how? I would appreciate the final recipe, as mod_rewrite and Porxypass is not my speciality... And I'm convinced that even those 2 proxypasses are wrong, but that's what they got me.

EDIT ACCORDING TO COMMENTS:

To sumarize, all is working porperly right now, but I need to write the URLs as explained before, to acces the proper zones. What I want is to change the behaviour of the server, according to what is logic, and let the simple TLD url go to user zone, and "/admin" to backend zone. I've added a rewirte from http to https which works OK. Now I've thought that I can add a rewrite which says:

"IF https://xin.foo.com THEN https://xin.foo.com/bar/bar?app=personal"

and

"IF https://xin.foo.com/admin THEN https://xin.foo.com/bar/bar"

With that, I guess the AJP proypasses should still working normally. And what would be of an A+ grade, would be to not to modify the URL on the browser, so people keep reading "https://xin.foo.com" for the real and "hidden" "https://xin.foo.com/bar/bar?app=personal".

Thanks you all so much, and kind regards.

  • First you didn't specified what isn't working in your setup. Next, the parameters: SSLProxyProtocol and SSLProxyCipherSuite are not needed with mod_proxy_ajp (which is different from mod_jk although both do AJP) because AJP does not handle encryption. Third, the way your app differentates between admin and user is unusual, usually it's the admin that needs parameters, not the other way around. Anyway, try clarifying first what does not work – Fredi Nov 10 '16 at 16:31
  • From what I've right now, all is working properly. But If I want to acces to users zone, I need to write on a browser "xin.foo.com/bar/bar?app=personal". And what I would like to write is simply "xin.foo.com" to acces on same site. For admin, I've to write "xin.foo.com/bar/bar", and I'll want to write "xin.foo.com/admin". Right now, I'm using mod_jk. And finally, totally agree about how wrong and unusual this is. But thats what I've got from developers. :( – Lightworker Nov 10 '16 at 17:23
  • As a public TLD "xin.foo.com" will only point to the Apache frontal public IP, it will always resolve to the typical index.html web which says "IT WORKS!". Normally, I acces to the frontal server using it's name, let's say "frontalApache01/bar/bar". But I've added a certificate SSL EV to Apache and it needs CN coincidence. That's why I've done the "windows hosts" trick on my machine. Now, all works if I do "xin.foo.com/bar/bar", which goes to the site. But people will do "xin.foo.com" and this serves the "It works!" Apache typical index web. – Lightworker Nov 10 '16 at 17:38
  • Up please! I really need an answer... :( – Lightworker Nov 14 '16 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.