Home / server / Questions / 408669
Accepted
Eli
Asked: 2012-07-18 15:12:33 +0800 CST

I have a proxy server pointing to my web server, where do I install my SSL?

  • 772

I just purchased an EV SSL and now need some guidance on how to install it.

I followed the step provided to me by Geotrust, but I can't figure out where to toss in my Proxy server into the mix.

The domain points to my proxy server, which then well proxy's in the content from my second server.

In my proxy server I have this in my httpd.conf

<VirtualHost *:80>
    ProxyPreserveHost On
    ProxyPass / http://xx.xx.xxx.xx:80/ connectiontimeout=300 timeout=300
    ProxyPassReverse / http://xx.xx.xxx.xx:80/
</VirtualHost *:80>

in my web server I have

ServerName domain.com
ServerAlias www.domain.com

DocumentRoot "/var/www/html"

<Directory "/var/www/html">
    AllowOverride All
        Order allow,deny
        Allow from all
</Directory>

I don't know where to insert this bit of code

SSLEngine on
SSLCertificateFile /path/to/public_ee.crt
SSLCertificateKeyFile /path/to/private.key
SSLCertificateChainFile /path/to/EV_intermediate.crt

If I add this to my webserver, then I get a "Bad Request" error from the proxy, but I can still access the url via https

Any clues on how to properly configure this type of setup?

Thank you for your help

centos apache-2.2 ssl

1 Answers

  1. Best Answer

    Since your proxy is going to be your "front door", you need to configure a separate https VirtualHost to run there. The SSL directives will go into that VH. It is likely that the default ssl.conf that came with your Apache setup contains everything you need to get that server running.

    I run something similar, and have found it useful to bring up SSL in three steps:

    1. Get a _default_:443 server running standalone on the front door
    2. Get the proxy directives working properly out of the SSL VirtualHost
    3. Change the port 80 VirtualHost to redirect to the SSL server

    That last step isn't strictly necessary for many people, but it is required in my environment. You don't necessarily need to run SSL between your proxy front end and your services layer, but if you do the setup is similar.

    • 4