Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have been trying to get a reverse proxy up and running for the past few hours for an application that now needs to be accessed publicly.

For security and provider-that-blocks-port-80 issues, the application can only be reached by https. I know this can be done either with apache or squid (among others). I have tried both and failed.

Current network is setup like so: is the gateway. On the gateway, apache is already configured with a default ssl vhost and squid runs as a regular forward proxy.

The application on local network, is setup and accessible as expected locally.

This is the config I tried on squid, at top of squid conf I added an include directive to /etc/squid/application.conf:


https_port 443 cert=/etc/pki/tls/certs/localhost.crt key=/etc/pki/tls/private/localhost.key vhost

# HTTPS peer
cache_peer parent 443 0 no-query originserver ssl    sslflags=DONT_VERIFY_PEER name=application
cache_mgr root
http_port 443 accel
acl all src

This approach fails and gives following error:

SSL connection error Unable to make a secure connection to the server. This may be a problem with the server, or it may be requiring a client authentication certificate that you don't have. Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error.

I then tried with apache, as I would prefer to keep the gateway listening on standard https port 443. The squid configuration would not work when apache was listening on 443, the default apache vhost was served.

This is what I tried with apache:

ssl.conf, after default vhost

         LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined
         CustomLog /var/log/httpd/application_log combined
         LogLevel Debug

        SSLProxyEngine On
        SSLCertificateFile /etc/pki/tls/certs/localhost.crt
        SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

        SSLProtocol all -SSLv2

      # RewriteEngine on
      # RewriteRule ^/$ /index.html [R]

       ProxyRequests off

       ProxyPass /
       ProxyPassReverse /

This would be my preferred way of doing it, all apps would run on port 443 but with this setup no matter what I tried the default vhost is always the one being served.

If anyone has a clue for either squid or apache, I would be most grateful.

share|improve this question
I think you need to add the SSLProxyEngine on and SSLEngine on directives to your apache conf. Also, have you loaded mod_proxy,mod_proxy_http and mod_ssl ? Also, do you need a Proxy "allow" set of directives like <Proxy>;\nOrder Deny, Allow\nAllow from all</proxy> ? – davidgo Feb 28 '13 at 8:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.