1

I have two AWS EC2 instances, a web server and an app server. My home page is on my web server. Before I used SSL, I was able to access a page, on my app server, from my homepage using

http://homePage.com/app1/page.php

My proxy-host.conf has the following content

<virtualhost *:80>
 ServerAdmin webmaster@localhost
 DocumentRoot /var/www/html/
 ErrorLog ${APACHE_LOG_DIR}/error.log
 CustomLog ${APACHE_LOG_DIR}/access.log combined
 ProxyPreserveHost On
# Servers to proxy the connection, or
# List of application servers Usage
 ProxyPass /app1/ http://10.0.1.22:80/
 # ProxyPass /app1/ http://10.0.1.22:443/
</virtualhost>

I have since changed /etc/apache2/ports.conf and /etc/apache2/httpd.conf so my home page always uses SSL with port 443. I have created a proxy-ssl-host.conf file with the following content.

<virtualHost *:443>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html/
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
    SSLEngine On
     # Set the path to SSL certificate
     # Usage: SSLCertificateFile /path/to/cert.pem
    SSLCertificateFile /etc/apache2/ssl/homepage.com.crt
    SSLCertificateKeyFile /etc/apache2/ssl/homepage.com.key
    ProxyPreserveHost On
    ProxyPass  /app1/ https://10.0.1.22:443/
    ProxyPassReverse  /app1/ https://10.0.1.22:443/
    ServerName localhost
</VirtualHost>

After making proxy-ssl-host.conf, I entered the following

sudo a2ensite  proxy-ssl-host.conf
sudo service apache2 reload
sudo systemctl restart apache2.service

Now, when I go to my browser and enter

https://homePage.com/app1/page.php

I get

The requested URL /app1/page.php was not found on this server.

Apache/2.4.18 (Ubuntu) Server at homePage.com Port 443

EDIT 1:

I tried

sudo netstat -ntpl | grep :443

on the app server and got nothing so apache was not listening on port 443 on that server. I added

Listen 443

after

Listen 80

in ports.conf and now get

tcp6       0      0 :::443                  :::*                    LISTEN      2205/apache2

after

sudo netstat -ntpl | grep :443

Unfortunately, that did not resolve either of my problems on the browser.

EDIT 2:

When I went to the web server and entered

 wget https://10.0.1.22/page.php

I got

--2018-02-18 20:58:32--  https://10.0.1.22/page.php
Connecting to 10.0.1.22:443... connected.
OpenSSL: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
Unable to establish SSL connection.

When I entered

wget https://10.0.1.22/app1/page.php

I got

--2018-02-18 20:59:37--  https://10.0.1.22/app1/page.php
Connecting to 10.0.1.22:443... connected.
OpenSSL: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
Unable to establish SSL connection.

When I entered

wget http://10.0.1.22

I got

--2018-02-18 19:32:45--  http://10.0.1.22/
Connecting to 10.0.1.22:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4198 (4.1K) [text/html]
Saving to: ‘index.html’

index.html                                100%[=====================================================================================>]   4.10K  --.-KB/s    in 0s

2018-02-18 19:32:45 (564 MB/s) - ‘index.html’ saved [4198/4198]

When I set up SSL on my DMZ, in my basement, I only needed to install the SSL certificates on my web server and they took effect on my app server as well. However, in my basement, they had the same public IP address. Also the web server ran CentOS and the app server Debian. With my cloud DMZ, they have different IP addresses and both run on Ubuntu. I was wondering if this necessitates setting up the certificates, on my app server, the same way that I set them up on my web server.

3
  • Is the content on 10.0.1.22 accesible directly using https ? If you do a tcpdump, do you see an attempt from the server to get the document? Do you have any other SSL virtualhost blocks which work with port 443?
    – davidgo
    Feb 18, 2018 at 2:38
  • If I enter the public IP address of 10.0.1.22 into the browser, the page loads. However, when I precede the public IP with https://, I get the message "This site can’t be reached. 32.32.32.32 refused to connect. ERR_CONNECTION_REFUSED" (where 32.32.32.32 represents the public IP address.). I could not see the document when I piped tcpdump into grep. I only have the two servers. Thanks, Feb 18, 2018 at 3:05
  • I added Listen 443 to the top of /etc/apache2/httpd.conf, and restarted apache, but the problems persist. Thanks, Feb 18, 2018 at 3:28

2 Answers 2

1

As you are using standard ports you can omit :443 and :80 from your proxy configuration.

The first test I would use is to verify that https://10.0.1.22:443/app1/page.php is accessible from your web server. The tools wget or curl are commonly used for this.

It is likely that SSL validation is failing for https://10.0.1.22. You will need an appropriate certificate on the server at 10.0.1.22 which must be listening for HTTPS traffic. It appears you are not rewriting the Host header, so you should be able to use the certificate from your front-end server on the back-end server.

I you trust your local network you could proxy to http://10.0.1.22. This will expose your app1 traffic to snooping on the local network.

1
  • Thank you for your reply. I have tried what you suggested and have put the results in EDIT 2 of my question. I was not sure if you meant to include app1 in 10.0.1.22:443/app1/page.php since /app1/ is supposed to be a proxy for 10.0.1.22:443. Anyway, I tried it both ways and got the same result. It seems that I need to set up the SSL certificate on the app server as well. I did not have to do that when I ran a DMZ in my basement but, in that case, they had the same public IP and different Linux distros. Thanks, Feb 18, 2018 at 21:18
1

I figured it out.

I was supposed to put ProxyPass outside the blocks. This changed the error to the one outlined here. I used their solution and the error now changed to the one outlined here. I used their solution and that completely fixed my problem.

So /etc/apache2/sites-available/proxy-host.conf becomes

SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
ProxyPass /app1/ https://ip-10-0-1-22/

<virtualhost *:80>
     ServerAdmin webmaster@localhost
     DocumentRoot /var/www/html/
     ErrorLog ${APACHE_LOG_DIR}/error.log
     CustomLog ${APACHE_LOG_DIR}/access.log combined
     ProxyPreserveHost On
    # Servers to proxy the connection, or
    # List of application servers Usage
     ProxyPass /app1/ https://ip-10-0-1-22.ec2.internal/
</virtualhost>

and /etc/apache2/sites-available/proxy-ssl-host.conf becomes

SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
ProxyPass  /app1/ https://ip-10-0-1-22/
ProxyPassReverse  /app1/ https://ip-10-0-1-22/

<virtualHost *:443>
        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/html/
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        SSLEngine On
         # Set the path to SSL certificate
         # Usage: SSLCertificateFile /path/to/cert.pem
        SSLEngine on
        SSLProxyEngine On
        ProxyRequests Off
        SSLCertificateFile /etc/apache2/ssl/clusterprism.com.crt
        SSLCertificateKeyFile /etc/apache2/ssl/clusterprism.com.key
        ProxyPass  /app1/ https://ip-10-0-1-22.ec2.internal/
        ProxyPassReverse  /app1/ https://ip-10-0-1-22.ec2.internal/
        ServerName localhost
</VirtualHost>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .