0

I need to proxing of HTTPS pages, that hidden behind router.

Public internet 
-> Router 
-> port forwarding 443 
-> first apache2 web server 
-> need proxying to my second apache2 web server

I'm port forwarding port 443 to my first local server (where is first.example.com running on 443), but second.example.com runs on sencond web server. And I need set proxy on first server to proxing me pages from second server.

I tried to edit Apache2 virtual host

<VirtualHost second.example.com:443>
...
 ProxyPass / https://second.example.com/
 ProxyPassRewerse / https://second.example.com/
...
</VirtualHost>

FIRST PROBLEM is that first Apache2 ignore VirtualHost second.example.com at all... because in local DNS second.example.com is routed to real second.example.com

SECOND PROBLEM when I change DNS to second.example.com routed to first server. ProxyPass rule to new DNS record https://second-on-second.example.com than my browser did not show content of HTTPS comunication, because od SNI error... because now certificate didn't coresponding domain. Same error will ocurrect, when I change ProxyPass to IP of second server.

Could me anybody help how do working proxying of web

0

The VirtualHost should BE first.example.com, doing a reverse proxy to second.example.com:

<VirtualHost *:443>
    ServerName first.example.com
    ...
    ProxyPass / https://second.example.com/
    ProxyPassRewerse / https://second.example.com/
</VirtualHost>

Then, if both of the web servers are inside your NAT, second.example.com isn't probably resolving to your internal IP address (lets say second A 192.168.0.2), which may cause a second problem.

If you need to have second.example.com in the Host: header, because the second sever only responds correctly with that virtual host name (and that name is also in its TLS certificate), add 192.168.0.2 second.example.com in the /etc/hosts of your first server.

If you don't need to have TLS inside your internal network, use plain HTTP between the servers:

  • On the second server

    • use <VirtualHost *:80> without TLS.
    • add ServerAlias 192.168.0.2 to make it work without /etc/hosts.
  • On the first server, have the following reverse proxy configuration:

    <VirtualHost *:443>
        ServerName first.example.com
        ...
        ProxyPass / http://192.168.0.2/
        ProxyPassRewerse / http://192.168.0.2/
    </VirtualHost>
    
| improve this answer | |
  • I think, that this solution, will create more problems, that solves. VirtualHost *:443 means force SSL certifikate to all host, and all host would be interpreted as this one :( finally server2 would have SSL certificate of server1... means bad domain certificate – user5332 May 15 '17 at 10:06
  • "VirtualHost *:443 means force SSL certifikate to all host" No, it doesn't. Read the documentation on <VirtualHost> Directive to know what the addr in it means. It must not be confused with ServerName Directive – and even that won't force TLS, like HSTS does. – Esa Jokinen May 15 '17 at 10:56
  • Hi, only one solution works for me. Change deklaration of to local IP of first server. It means this <VirtualHost 10.0.0.11:443>! I tryed <VirtualHost *:443> and it did not work, because apache ignore VirtualHost declaration at all :( So thanks, for direction of right way. – user5332 May 16 '17 at 11:32
  • So you are using my solution, but <VirtualHost 10.0.0.11:443> instead of *:433? If so, you could accept / upvote. The difference you have there is related to something else in your configuration, but the ServerName and ProxyPass in my answer should be needed to achieve your goal. – Esa Jokinen May 16 '17 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.