0

I need to connect to an external server via SSL which only accepts certificates exchange following this architecture :

Client (my Nodejs server) -----http-----> (Reverse?) Proxy ----https-----> External Server asking for certificate.

I don't own the external server, but they have my certificates installed in their system.

I used Let's Encrypt to generate certificates, so I have 4 files :

privkey.pem --> Private Key
cert.pem --> Public Key
chain.pem --> Certificate Chain
fullchain.pem --> Concatenation of cert.pem and chain.pem

Current, not working, apache 2.4.33 vhost configuration :

<VirtualHost *:80>
    SSLProxyEngine On
    SSLProxyVerify require

    SSLCertificateFile path/fullchain.pem
    SSLCertificateKeyFile path/privkey.pem

    SSLProxyMachineCertificateChainFile path/fullchain.pem
    SSLProxyCACertificateFile path/fullchain.pem
    # mydomain.certandkey.pem is a concatenation of cert.pem and privkey.pem
    SSLProxyMachineCertificateFile mydomain.certandkey.pem

    ProxyRequests Off
    RewriteEngine On
    #ProxyPreserveHost On
    #<Proxy *>
    #Order deny,allow
    #Allow from all
    #</Proxy>

    ProxyPass / https://external.server.com/
    ProxyPassReverse / https://external.server.com/
</VirtualHost>

The apache error log is 

AH02252: incomplete client cert configured for SSL proxy (missing or encrypted private key?)
[date] [ssl:emerg] [pid 76986] AH02312: Fatal error initialising mod_ssl, exiting.
AH00016: Configuration Failed

It seems to come from SSLProxyMachineCertificateFile as it goes away when I comment the corresponding line (but connection doesn't doesn't work).

Does any one have an idea how to fix this or meet a similar connection situation ?

I've spent my last two days looking over the internet and trying many configurations, it drives me crazy.

Thank you very much.

tristao
  • 3
  • 1
  • 2
  • Can you explain how did you make mydomain.certandkey.pem file? I tried to concatenate cert.pem and privkey.pem but it was rejected. – Stan Sokolov Jul 20 '21 at 21:45

2 Answers2

0

Based from the error, the private key is encrypted. For the reverse proxy to use the client cert, the private key needs to be decrypted.

Example:

openssl rsa -in my.key -out dec.key       
Enter pass phrase for my.key:
writing RSA key

SSLProxyMachineCertificateFile Directive

Currently there is no support for encrypted private keys

Hansilog
  • 11
  • 1
  • 1
  • 3
0

You are trying to use certificates that can't be used for this purpose.

Quote from the Apache documentation for SSLProxyMachineCertificateFile

File of concatenated PEM-encoded client certificates and keys to be used by the proxy

(highlighting by me)

From the Let's Encrypt FAQ:

Does Let’s Encrypt issue certificates for anything other than SSL/TLS for websites?

Let’s Encrypt certificates are standard Domain Validation certificates, so you can use them for any server that uses a domain name, like web servers, mail servers, FTP servers, and many more.

Email encryption and code signing require a different type of certificate that Let’s Encrypt does not issue.

Client auth falls into the email encryption and code sigining category. The certificates need to be created for this purpose. Let's Encrypt certificates are for server use only.

Community
  • 1
Gerald Schneider
  • 23,274
  • 8
  • 57
  • 89
  • Thank you very much for the quick answer, it looks clearer to me. What misled me is that the company holding the server gave me a list of CA and Let's Encrypt is part of it. While after checking, they mention client certificate, which seems incompatible with Let's Encrypt. If I'm not mistaken from reading your answer, I can't use Let's Encrypt and need to find an other CA to get a client certificate for my server. Is that right ? – tristao May 16 '19 at 15:30
  • This is incorrect. SSL/TLS client auth is NOT the same category as email or codesigning, and although it _can_ be distinct from server auth, **Let's Encrypt issues EKU with both serverAuth and clientAuth** (and did since 2016 at latest) and so does every other SSL/TLS CA I've ever looked at. – dave_thompson_085 Jun 17 '22 at 03:42