I currently created an apache reverse proxy with SSL. During testing, I did this:

Key in > browser asks for credentials > I enter credentials > browser goes to > browser asks for credentials again > I enter credentials again > browser finally shows website, but as http.

In my CentOS where I created my apache, I created a file called default.conf under the directory "/etc/httpd/conf.d/default.conf" with the following contents:

<IfModule mod_proxy.c>

ProxyRequests Off
ProxyPreserveHost On
ProxyReceiveBufferSize 4096

<Proxy *>
    Order deny,allow
    Allow from all
ProxyPass / http://intraspace/
ProxyPassReverse / http://intraspace/

#RewriteEngine On
  #RewriteCond %{SERVER_PORT} !443
  #RewriteRule ^(.*)$ https://intraspace/$1 [R,L]

<Location />
Order allow,deny
Allow from all

intraspace refers to my backend server (the one hidden by my reverse proxy). I commented the rewrite rules because if I realized that if I use them, it will reveal either redirect & reveal my local ip address of my apache (when I type in my public ip of my apache) or cause "internal error" when I try any other ip addresses (the backend server ip or the public ip of apache)

How do I resolve this issue of double authentication/redirection, and make my website ip stay at the https version?

  • 1
    You are redirecting to an http website through the proxypass directive. – termcap Dec 28 '17 at 10:01

Its probably the inraspace is seeing http so returning everything http. If the app handles it you can setup

RequestHeader set X-Forwarded-Proto "https"

Above the proxypass lines and that will tell the backend that ssl has been terminated if the app supports that header

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.