-1

I'm beginner with Apache, I have a issue when my website call ajax to api server.

Example:

https://example.com:11721 (self signed certificate)

https://api.example.com (self signed certificate)

GET Request: https://example.com:11721/api/message -> https://api.example.com/api/message

PUT Request: https://example.com:11721/api/message/read -> https://api.example.com/api/message/read

My config can call get request, but put/post request response (403 forbidden).

Here my apache config:

<IfDefine SSL>
<VirtualHost *:11721>
    ServerName  https://example.com
    ServerAlias example.com
    RewriteEngine on
    include conf/security.conf
    include conf/method.conf
    include conf/extension.conf
    include app_conf.d/https.mydomain.conf

    SetEnv SERVER_URL https://example.com
    SetEnv HTTPS ON
    #add SSL
    SSLEngine on

    # ---- Bellow config allow get request but put/post request response 403, if don't config follow it server will response 500.----------
    SSLProxyEngine on
    SSLProxyVerify none
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off
    # ------ END ---------

    ProxyPass "/api" "https://ip-api-sever/api"
    ProxyPassReverse "/api" "https://ip-api-sever/api"

    SSLCertificateFile "/usr/local/apache/2.4.10/conf/server.crt"
    SSLCertificateKeyFile "/usr/local/apache/2.4.10/conf/server.key"

    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

    CustomLog "|/usr/local/apache/2.4/bin/rotatelogs /var/apachelog/common/ssl/access.log.%Y%m%d%H%M%S 3600 +540" fanformat env=!images

    #mod_balancer
    include conf.d/proxy.https.mydomain.conf

</VirtualHost>
</IfDefine>

Please help me, Thank


Thank you for your support.

After change config follow you, I think you are right. But I get another error.

My error log :

[Thu Apr 19 16:21:46.115579 2018] [ssl:debug] [pid 1183] ssl_engine_kernel.c(1378): [remote xx.xx.xx.xx:443] AH02275: Certificate Verification, depth 2, CRL checking mode: none [subject: CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=(c) 2006 VeriSign\, Inc. - For authorized use only,OU=VeriSign Trust Network,O=VeriSign\, Inc.,C=US / issuer: OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US / serial: xxxxxxxxxx/ notbefore: Nov 8 00:00:00 2006 GMT / notafter: Nov 7 23:59:59 2021 GMT]

[Thu Apr 19 16:21:46.115703 2018] [ssl:info] [pid 1183] [remote xx.xx.xx.xx:443] AH02276: Certificate Verification: Error (20): unable to get local issuer certificate [subject: CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=(c) 2006 VeriSign\, Inc. - For authorized use only,OU=VeriSign Trust Network,O=VeriSign\, Inc.,C=US / issuer: OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US / serial: xxxxxxxxxxxxxxxxx/ notbefore: Nov 8 00:00:00 2006 GMT / notafter: Nov 7 23:59:59 2021 GMT]

[Thu Apr 19 16:21:46.115902 2018] [ssl:info] [pid 1183] [remote xx.xx.xx.xx:443] AH02003: SSL Proxy connect failed

[Thu Apr 19 16:21:46.115960 2018] [ssl:info] [pid 1183] SSL Library Error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

[Thu Apr 19 16:21:46.115979 2018] [ssl:info] [pid 1183] [remote xx.xx.xx.xx:443] AH01998: Connection closed to child 0 with abortive shutdown (server mydomain:443)

[Thu Apr 19 16:21:46.116014 2018] [ssl:info] [pid 1183] [remote xx.xx.xx.xx:443] AH01997: SSL handshake failed: sending 502

[Thu Apr 19 16:21:46.116064 2018] [proxy_http:error] [pid 1183] (103)Software caused connection abort: [client 10.128.14.1:48138] AH01102: error reading status line from remote server xx.xx.xx.xx:443 [Thu Apr 19 16:21:46.116115 2018] [proxy_http:debug] [pid 1183] mod_proxy_http.c(1369): [client 10.128.14.1:48138] AH01105: NOT Closing connection to client although reading from backend server xx.xx.xx.xx:443 failed.

Do you know how to resolve this?

Thank you.

  • check logs on your api.example.com. – AlexD Apr 17 '18 at 19:33
  • @AlexD , I can't access server api. If I can, I will resolve this problem. – Cuong Le Apr 18 '18 at 1:36
0

You mentioned that you are using a self-signed certificate on the proxy server. In this case, you will have to include the SSLProxyCACertificateFile directive in order to let your current server trust the self-signed certificate presented by the proxy server. Remember, to include the path to the CA certificate as well.

The part of the config needed to be changed / added:

SSLProxyVerify require
SSLProxyVerifyDepth 1
SSLProxyCACertificateFile "/path/to/the/CACertifcateFile"
SSLProxyCheckPeerName on

So your whole configuration file should look like:

<IfDefine SSL>
<VirtualHost *:11721>

    #----Local Configuration:#

    ServerName  https://example.com
    ServerAlias example.com
    RewriteEngine on
    include conf/security.conf
    include conf/method.conf
    include conf/extension.conf
    include app_conf.d/https.mydomain.conf

    SetEnv SERVER_URL https://example.com
    SetEnv HTTPS ON


    SSLEngine on
    SSLCertificateFile "/usr/local/apache/2.4.10/conf/server.crt"
    SSLCertificateKeyFile "/usr/local/apache/2.4.10/conf/server.key"

    #----Proxy Configuration:#

    SSLProxyEngine on

    ProxyRequest off
    ProxyPass "/api" "https://ip-api-sever/api"
    ProxyPassReverse "/api" "https://ip-api-sever/api"

    SSLProxyVerify require
    SSLProxyVerifyDepth 1
    SSLProxyCACertificateFile "/path/to/the/CACertifcateFile"
    SSLProxyCheckPeerName on

    #----Local Configuration:#        

    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

    CustomLog "|/usr/local/apache/2.4/bin/rotatelogs /var/apachelog/common/ssl/access.log.%Y%m%d%H%M%S 3600 +540" fanformat env=!images

    #mod_balancer
    include conf.d/proxy.https.mydomain.conf

</VirtualHost>
</IfDefine>
  • Thank you, You save my life :) but I get another error response. – Cuong Le Apr 19 '18 at 9:25
  • @CuongLe May you post your new config again? It seems like your are not using the right CA certificate – Alex Lo Apr 19 '18 at 10:29
0

You are missing a " for the ProxyPassReverse directive. That's why GET requests work but POST/PUT requests don't.

Change this:

 ProxyPass "/api" "https://ip-api-sever/api"
 ProxyPassReverse /api" "https://ip-api-sever/api"

To this:

 ProxyPass "/api" "https://ip-api-sever/api"
 ProxyPassReverse "/api" "https://ip-api-sever/api"
  • Thank you for your comment. Sorry, it's my mistake when I replace with dummy url. In my server, It don't missing double quote. Do you know another reason? – Cuong Le Apr 19 '18 at 2:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.