-1

We have a proxy and several hidden web servers in different locations. Internet users can visit these hidden web servers only through the proxy, so only the proxy IP is public. The IPs of the web servers are only known by the proxy.

Now we want to apply for SSL certificates for each of the hidden websites through the proxy. Is this possible or not?

3
  • Just signed a certificate yourself and provide instructions on how to import the certificate on the target ssytems.
    – Ramhound
    May 31, 2013 at 12:40
  • What kind of proxy you ask about — a forward proxy (clients need to be configured to use the proxy, then they can access sites behind that proxy), or a reverse proxy (clients access the proxy as if it was the web server and do not need to know names of real web servers in your internal network)? May 31, 2013 at 13:34
  • I'm asking about forward proxy
    – misteryes
    May 31, 2013 at 14:15

2 Answers 2

1
  • if you have FQDN for the internal websites then you will not have any problems getting certificates. They are dirt cheap now.
  • if your servers behind the proxy have names like webserver1.local than forget about trusted CA signed SSLs. In that case you ether change addresses to FQDN or set up your own CA.

If your CA gets breached then you will have to revoke all your certs!

Do you have those websites behind PROXY with internal IPs or are they accessible (but protected by firewalls) through the normal, "external" IPs?

Giving SSL to the proxy only means that there could be no encryption between proxy and servers. This will be like a "Man In The Middle Attack" - you will trust Proxy BUT NOT WEBSITES.

Now, SSL is about the trust. To stand up a proper internal CA, then add 2ndary CA, sign 2ndary CA, distribute and install root CA certificates, maintain them, maintain your own signed SSLs it's just not worth the hassle. AlphaSSL is about $10/year with discounts for multiple years. You don't have to worry about standing up and protecting your own CA, distributing certificates etc - AlphaSSL is signed by GeoTrust and is well trusted across the board. You could use other CAs as well - this is just an example.

9
  • 1
    See also this blog post by Eddy Nigg, the founder of StartCom, where he points out the danger of certificates with nonunique names like foo.local, which some other CAs were happily issuing. May 31, 2013 at 13:24
  • @SergeyVlasov Yes! Good that this is just the past now. Don't get me started about using .local in general...
    – Chris
    May 31, 2013 at 13:26
  • these websites have FQDN, but from DNS query these FQDNs are all mapped to the IP of the proxy.
    – misteryes
    May 31, 2013 at 14:26
  • setting up my own CA and let public CA authorize the CA? so it is hierachical?
    – misteryes
    May 31, 2013 at 14:27
  • You want to have your CA signed by another CA so other - all - internet users will trust your CA? No, no one will do that. No one will sign your CA.
    – Chris
    May 31, 2013 at 14:35
1

Why would you get a certificate for each of those webservers? Why not just hand one to the proxy?

If you need SSL Communication between the Webservers and the proxy setup a private CA and exchange the public keys. You could use this as a starting point (using openssl)

2
  • Getting a certificate just for the proxy will not work with normal HTTP proxies — the server name used in the URL must match one of DNS names included in the certificate, and the proxy name does not matter. In fact, currently only Chrome can support protecting the connection to the HTTP proxy itself with TLS; other browsers use just a cleartext connection between the client and the proxy server, and only the tunnel between the client and the real HTTPS server is protected. May 31, 2013 at 13:19
  • @SergeyVlasov That really depends on your setup :-) Because to me this really sounds like a reverse proxy not a forward, but maybe I'm getting him wrong.
    – Alessandro
    May 31, 2013 at 13:37

Not the answer you're looking for? Browse other questions tagged .