0

I'm beginner with Apache, I have a issue when my website call ajax to api server.

Example:

https://example.com:11721 (self signed certificate)

https://api.example.com (self signed certificate)

GET Request: https://example.com:11721/api/message -> https://api.example.com/api/message

PUT Request: https://example.com:11721/api/message/read -> https://api.example.com/api/message/read

My config can call get request, but put/post request response (403 forbidden).

Here my apache config:

<IfDefine SSL>
<VirtualHost *:11721>
    ServerName  https://example.com
    ServerAlias example.com
    RewriteEngine on
    include conf/security.conf
    include conf/method.conf
    include conf/extension.conf
    include app_conf.d/https.mydomain.conf

    SetEnv SERVER_URL https://example.com
    SetEnv HTTPS ON
    #add SSL
    SSLEngine on
    
    # ---- Bellow config allow get request but put/post request response 403, if don't config follow it server will response 500.----------
    SSLProxyEngine on
    SSLProxyVerify none
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off
    # ------ END ---------

    ProxyPass "/api" "https://ip-api-sever/api"
    ProxyPassReverse "/api" "https://ip-api-sever/api"

    SSLCertificateFile "/usr/local/apache/2.4.10/conf/server.crt"
    SSLCertificateKeyFile "/usr/local/apache/2.4.10/conf/server.key"
    
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

    CustomLog "|/usr/local/apache/2.4/bin/rotatelogs /var/apachelog/common/ssl/access.log.%Y%m%d%H%M%S 3600 +540" fanformat env=!images

    #mod_balancer
    include conf.d/proxy.https.mydomain.conf

</VirtualHost>
</IfDefine>

Please help me, Thank


Thank you for your support.

After change config follow you, I think you are right. But I get another error.

My error log :

[Thu Apr 19 16:21:46.115579 2018] [ssl:debug] [pid 1183] ssl_engine_kernel.c(1378): [remote xx.xx.xx.xx:443] AH02275: Certificate Verification, depth 2, CRL checking mode: none [subject: CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=(c) 2006 VeriSign\, Inc. - For authorized use only,OU=VeriSign Trust Network,O=VeriSign\, Inc.,C=US / issuer: OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US / serial: xxxxxxxxxx/ notbefore: Nov 8 00:00:00 2006 GMT / notafter: Nov 7 23:59:59 2021 GMT]

[Thu Apr 19 16:21:46.115703 2018] [ssl:info] [pid 1183] [remote xx.xx.xx.xx:443] AH02276: Certificate Verification: Error (20): unable to get local issuer certificate [subject: CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=(c) 2006 VeriSign\, Inc. - For authorized use only,OU=VeriSign Trust Network,O=VeriSign\, Inc.,C=US / issuer: OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US / serial: xxxxxxxxxxxxxxxxx/ notbefore: Nov 8 00:00:00 2006 GMT / notafter: Nov 7 23:59:59 2021 GMT]

[Thu Apr 19 16:21:46.115902 2018] [ssl:info] [pid 1183] [remote xx.xx.xx.xx:443] AH02003: SSL Proxy connect failed

[Thu Apr 19 16:21:46.115960 2018] [ssl:info] [pid 1183] SSL Library Error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

[Thu Apr 19 16:21:46.115979 2018] [ssl:info] [pid 1183] [remote xx.xx.xx.xx:443] AH01998: Connection closed to child 0 with abortive shutdown (server mydomain:443)

[Thu Apr 19 16:21:46.116014 2018] [ssl:info] [pid 1183] [remote xx.xx.xx.xx:443] AH01997: SSL handshake failed: sending 502

[Thu Apr 19 16:21:46.116064 2018] [proxy_http:error] [pid 1183] (103)Software caused connection abort: [client 10.128.14.1:48138] AH01102: error reading status line from remote server xx.xx.xx.xx:443 [Thu Apr 19 16:21:46.116115 2018] [proxy_http:debug] [pid 1183] mod_proxy_http.c(1369): [client 10.128.14.1:48138] AH01105: NOT Closing connection to client although reading from backend server xx.xx.xx.xx:443 failed.

Do you know how to resolve this?

Thank you.

3
  • check logs on your api.example.com.
    – AlexD
    Apr 17, 2018 at 19:33
  • @AlexD , I can't access server api. If I can, I will resolve this problem.
    – Cuong Le
    Apr 18, 2018 at 1:36
  • Experiencing the very same issue, were you able to solve it?
    – r3dst0rm
    Aug 4, 2021 at 17:54

2 Answers 2

0

You mentioned that you are using a self-signed certificate on the proxy server. In this case, you will have to include the SSLProxyCACertificateFile directive in order to let your current server trust the self-signed certificate presented by the proxy server. Remember, to include the path to the CA certificate as well.

The part of the config needed to be changed / added:

SSLProxyVerify require
SSLProxyVerifyDepth 1
SSLProxyCACertificateFile "/path/to/the/CACertifcateFile"
SSLProxyCheckPeerName on

So your whole configuration file should look like:

<IfDefine SSL>
<VirtualHost *:11721>

    #----Local Configuration:#

    ServerName  https://example.com
    ServerAlias example.com
    RewriteEngine on
    include conf/security.conf
    include conf/method.conf
    include conf/extension.conf
    include app_conf.d/https.mydomain.conf

    SetEnv SERVER_URL https://example.com
    SetEnv HTTPS ON


    SSLEngine on
    SSLCertificateFile "/usr/local/apache/2.4.10/conf/server.crt"
    SSLCertificateKeyFile "/usr/local/apache/2.4.10/conf/server.key"

    #----Proxy Configuration:#

    SSLProxyEngine on

    ProxyRequest off
    ProxyPass "/api" "https://ip-api-sever/api"
    ProxyPassReverse "/api" "https://ip-api-sever/api"

    SSLProxyVerify require
    SSLProxyVerifyDepth 1
    SSLProxyCACertificateFile "/path/to/the/CACertifcateFile"
    SSLProxyCheckPeerName on

    #----Local Configuration:#        

    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

    CustomLog "|/usr/local/apache/2.4/bin/rotatelogs /var/apachelog/common/ssl/access.log.%Y%m%d%H%M%S 3600 +540" fanformat env=!images

    #mod_balancer
    include conf.d/proxy.https.mydomain.conf

</VirtualHost>
</IfDefine>
2
  • Thank you, You save my life :) but I get another error response.
    – Cuong Le
    Apr 19, 2018 at 9:25
  • @CuongLe May you post your new config again? It seems like your are not using the right CA certificate
    – Algo7
    Apr 19, 2018 at 10:29
0

You are missing a " for the ProxyPassReverse directive. That's why GET requests work but POST/PUT requests don't.

Change this:

 ProxyPass "/api" "https://ip-api-sever/api"
 ProxyPassReverse /api" "https://ip-api-sever/api"

To this:

 ProxyPass "/api" "https://ip-api-sever/api"
 ProxyPassReverse "/api" "https://ip-api-sever/api"
1
  • Thank you for your comment. Sorry, it's my mistake when I replace with dummy url. In my server, It don't missing double quote. Do you know another reason?
    – Cuong Le
    Apr 19, 2018 at 2:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .