1

I use an Apache2 as proxy for several backend-server. The proxy holds the Let´s-Encrypt-SSL-Certificates for all servers, http-traffic is redirected to https and then proxyed to the http-backend-servers.

Everything is running smoothly, but:

One of the backend-servers hold a Moodle-Installation. Every link points to the http-url, so browsers say, there is insecure content...

How can I manipulate the page-content, that is delivered from the backend via the proxy to the client? I will have to replace every link "http://my.doimain.com/" with "https://my.domain.com/" within the delivered pages...

The traffic between proxy and backend-serer is http, not https. As theses servers have no internet-access they cannot update certificates issued by let´s encrypt...

Thanks in advance wepp

1

Two possible approaches:

  • Install certificates on the back-end servers so they can support https and then reconfigure the web application to run on the HTTPS back-end so that it will generate https links when referencing to itself.
    You don't need a valid certificate and can make do with a self-signed certificate on the back-end server(s) because by default mod_proxy_http does not check the certificate (see SSLProxyVerify)

  • You can rewrite the HTML pages your web application generates and rewrite any occurrence of http://www.example.com with mod_proxy_html and the ProxyHTMLURLMap Directive. A basic example would be:

    ProxyHTMLURLMap http://internal2.example.com https://www.example.com
    
0

Thanks HBruijn, you pointed me to the right direction.

Here is everything you need for getting this to work...
Within your VirtualHost-File add after the SSL-settings:

<VirtualHost *:443>
...
...
ProxyPass / http://backend-server/
ProxyPreserveHost On

SetOutputFilter INFLATE;proxy-html;DEFLATE
ProxyHTMLExtended Off
ProxyHTMLInterp On
ProxyHTMLDoctype XHTML Legacy
ProxyPassReverse / http://backend-server/

ProxyHTMLURLMap http://external.server.address https://external.server.address

</VirtualHost>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.