How can I use Apache as a reverse proxy for https?

Question

My company uses a CMS system hosted in the cloud. We want to create internally DNS-aliases to make it easier for developers to remember. Reading the documentation for mod_proxy_connect I do think it should be possible to do something like

<VirtualHost *:443>
 ServerAdmin mellomvaredrift@mycorp.no
 ServerName test-cms.mycorp.no

 AllowCONNECT
 ProxyPass /  https://mycorp-xpqa-lb-8qh7ip0n.cms.cloud/mycorp
 ProxyPassReverse /  https://mycorp-xpqa-lb-8qh7ip0n.cms.cloud/mycorp
</VirtualHost>

Until now I have not been able to get this to work, worth mentioning is

I do not have access to the certificate/key of the CMS-system, other than the public vert.

Is this possible to do using Apache?

score 5 · Answer 1 · edited Apr 26 '19 at 00:12

My company uses a CMS system hosted in the cloud. We want to create internally DNS-aliases to make it easier for developers to remember.

_{If your developers can't follow the link you provide them with and can't create a bookmark when it's too difficult to remember I'd worry about that...}

I also think you are probably thinking too technical and DIY ; I'd start by contacting the CMS provider and state that you want to use your own domain to access the CMS. They can probably (re)configure their service so that it works with your preferred domain and associated TLS certificate.

Then the only config you need to maintain on your side is the DNS CNAME record to points test-cms.example.com. to mycorp-xpqa-lb-8qh7ip0n.cms.cloud.

Now back to your Apache config.

mod_proxy_connect is only needed for a forward HTTPS proxy, you're setting up a reverse proxy and don't need AllowCONNECT.

Your reverse proxy also needs its own TLS certificate, which is missing in your code.

Often mapping different URL paths in a reverse proxy, / to /mycorp, leads to incompatibilities, as do unbalanced trailing slashes.

Consider this instead:

  RedirectMatch ^/$ /mycorp
  ProxyPass /  https://mycorp-xpqa-lb-8qh7ip0n.cms.cloud/
  ProxyPassReverse /  https://mycorp-xpqa-lb-8qh7ip0n.cms.cloud/

That redirects requests for the root, the bare subdomain to the correct sub directory and also insures to for instance content from shared, not company specific, directories such as https://mycorp-xpqa-lb-8qh7ip0n.cms.cloud/common will remain available.

<VirtualHost *:443>
  ServerName test-cms.example.com

  SSLEngine on
  SSLCertificateFile /etc/apache2/ssl/test-cms.example.com.crt
  SSLCertificateKeyFile /etc/apache2/ssl/test-cms.example.com.key

  RedirectMatch ^/$ /mycorp
  SSLProxyEngine on
  ProxyPass /  https://mycorp-xpqa-lb-8qh7ip0n.cms.cloud/
  ProxyPassReverse /  https://mycorp-xpqa-lb-8qh7ip0n.cms.cloud/

</VirtualHost>

Any sufficiently advanced security configuration on the side of the CMS may still detect that an unknown domain name is used and subsequently deny access.

Hmm, seems that I must have another issue than just the Apache config. When proxypassing another internal URL it works, but not for all internal either. When trying to proxypass to the CMS in the cloud I only get http 503, and the error is (OS 10060)A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. : AH00957: HTTPS: attempt to connect — rhellem, Apr 25 '19 at 18:32
Whether I have SSLProxyEngine on or not does not help to solve my issue. Strange thing is that Apache says it cannot connect, but if I try to access the cloud service from a browser on the server - it works. So it should be possible to connect - no firewall or such blocking. — rhellem, Apr 26 '19 at 06:40

score 4 · Accepted Answer · answered May 02 '19 at 06:23

The answer by HBruijn did explain some of the tricky parts for me, but I have still not been able to solve it. But I have managed to get around the SSL-issue simply by adding

SSLProxyEngine on
SSLProxyVerify none

What does not seem to work, also ref. the answer posted by HBruijn and the line

 RedirectMatch ^/$ /mycorp

it does not work. The / returns http 404 and that is what I get, but if /mycorp had been added I would expect a http 401.

But, I will create a new question for this issue.

How can I use Apache as a reverse proxy for https?

2 Answers2

Linked