Home / server / Questions / 266322
In Process
jemminger
Asked: 2011-05-05 09:54:13 +0800 CST

ssl between balancer members?

  • 772

I have apache running on one machine as a load balancer:

<VirtualHost *:443>
  ServerName    ssl.example.com
  DocumentRoot  /home/example/public

  SSLEngine             on
  SSLCertificateFile    /etc/pki/tls/certs/example.crt
  SSLCertificateKeyFile /etc/pki/tls/private/example.key

  <Proxy balancer://myappcluster>
    BalancerMember http://app1.example.com:12345 route=app1
    BalancerMember http://app2.example.com:12345 route=app2
  </Proxy>

  ProxyPass         / balancer://myappcluster/ stickysession=_myapp_session
  ProxyPassReverse  / balancer://myappcluster/

</VirtualHost>

Note that the balancer takes requests under SSL port 443, but then communicates to the balancer members on a non-ssl port. Is it possible to have the forwarding to the balancer members be under SSL too?

If so, is this the best/recommended way?

If so, do I have to have another SSL cert for each balancer member?

Does the SSLProxyEngine directive have anything to do with this?

apache-2.2 ssl mod-balancer

3 Answers

  1. Yes, you're on the right track. You'll want to set up an SSL listener on your backend devices.

    You will need certs for them, but it can probably just be self-signed ones - unless you set a SSLProxyVerify command, Apache doesn't care about authenticating them (of course, you can have it verify if you choose)

    And yes, set an SSLProxyEngine on, and change your ProxyPass directives to https and the correct new port.

    • 1

  2. You don't want to do this. Your Apache HTTPD balancer should be running in the same LAN as the Tomcats so SSL shouldn't be required, and in any case Apache HTTP has to be the SSL endpoint to the client anyway, and also a trusted SSL endpoint to Tomcat. There's no point in the second part of that.

    You can configure Apache HTTPD SSL so as to pass on the client certificates etc over AJP so your web-app can't actually tell it isn't SSL, and the degree to which you can customize SSL right down to the directory level in Apache HTTPD makes it a far better place to handle SSL configuration anyway.

    • 0

  3. I found that if you balance SSL to non-SSL Tomcat, then the Tomcat app gets its base set to the non-ssl URL, which seems to cause problems with a mixture of SSL and non-SSL content. Passing SSL to an SSL Tomcat works fine.

    • 0