How to daisy chain two web (Apache) servers with one in DMZ and the other in secure zone?

Question

I need to daisy chain two Apache servers for following reason.

A server-side application is compiled as a CGI module. It needs to work with databases, which are in secure zones behind firewalls. That requires the application to also be in secure zone. As a solution, we are contemplating setting up two daisy chained Apache servers: one in DMZ (A), and the other behind firewalls (B). The CGI application will be part of the Apache server B, which will be in secure zone.

Here is what the server configuration/traffic routing is envisioned as:

• Server A will be in DMZ. It will be the first point of contact for incoming client requests. It will also be the last point for outgoing responses to client. SSL (https) is enabled on this server.
• When server A receives a request (over HTTPS), it will examine the query string, and for certain patterns it will forward the request to Apache Server B which is in secure zone behind firewalls. Note: the server A is a "front end" for a few other internet applications as well, some of which are running on Tomcat in secure zone (they get requests forwarded to them using mod_jk).
• Server B will hand over the request payload to CGI application, which will process the request and pass back the response to its Apache server (i.e. server B). Server B will then pass the response back to server A, which will send it back to the client. It is just like the traffic movement between an Apache and Tomcat server talking through mod_jk.

A few questions:

1. Can two web servers be daisy chained like I have described? Just like how Apache can "daisy chain" with Tomcat using mod_jk.
2. Server A will be SSL (HTTPS) enabled. Will the Server B need to be SSL enabled as well?
3. Assuming that daisy chaining is possible, when server A forwards the request it received over HTTPS to server B, does it go over to server B as HTTPS or just plain HTTP? Or, is it something that we control? How?

Answer 1

1. Yes, you can daisy chain webservers. This is, effectively, what a proxy server is. (Actually a reverse proxy - and thats what you would want to google for more research).

2. No, server B does not need to be SSL enabled. You can use mod_proxy (apache) or equivalent to strip the SSL. This is very, very common in load balancing/sharing environments. (I happen to maitain a couple of these !)

3. In my setup it normally goes over as HTTP. I imagine if you use squid (a proxy/reverse proxy) you can make it do HTTPS - I've not tried it but it looks like Apache can do this as well. Look at http://httpd.apache.org/docs/2.2/mod/mod_proxy.html and search the page for "https://backend"