0

We are using Network level Loadbalancer, which redirects all the http calls to https.

The site hosting is configured where our SSL certificates are installed on the load balancer rather than in Apache Proxy (SSL offloading).

Apache web server is used only as a reverse proxy(via mod_proxy).

This results in the traffic between the load balancer and the Apache Proxy taking place over HTTP (unencrypted).

Flow :
1. http://example.com (hit on browser)
2. https://example.com (redirection via LB)
3. https://example.com (hit on browser)
4. http://example.com/uri (Apache web server via mod_rewrite)
(The issue is that Apache Proxy is unaware that the original protocol was HTTPS and sends back an HTTP reference.)
5. https://example.com/uri (Load Balancer again redirects it to https).

The combination of SSL offloading and the reverse proxy rewriting the URL (only once) is resulting in the initial request to the application to flap between HTTP and HTTPS twice. 

Workaround tried : RequestHeader set X-Forwarded-Proto https (No luck).

  • 1
    Where is the question ? – binarym Oct 17 at 11:13
  • They might want their Apache Web-Server to be working strictly on H.T.T.P., I cannot imagine why. – DOBRESCU_Mihai Oct 17 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.