Apache - exposing webapp on port using subdomain / route with SSL

Question

I'm trying to expose web app via subdomain with SSL or via route.

Subdomain Method:

The webapp I'm running is on port: http://localhost:4567/

With the following configuration, the web browser tells me the app is "not secure" (non-https).

The app is generally working fine, but is non-https.

What am I doing wrong? Are there alternative configurations?

<IfModule mod_ssl.c>
    Listen 443
    NameVirtualHost *:443
</IfModule>

<VirtualHost *:80>
  ServerName blast.example.com
  Redirect permanent / https://blast.example.com/
</VirtualHost>

<IfModule mod_ssl.c>

<VirtualHost *:443>
    ServerAdmin me@gmail.com
    ServerName blast.example.com
    # ProxyPreserveHost On
    ProxyRequests off

    # setup the proxy
    <Proxy *>
        Order allow,deny
        Allow from all
    </Proxy>
#    ProxyPass / http://localhost:4567/
#    ProxyPassReverse / http://localhost:4567/

  <Location />
    ProxyPass http://localhost:4567/
    ProxyPassReverse http://localhost:4567/
  </Location>

  SSLEngine on
  SSLProtocol all -SSLv2 -SSLv3
  SSLCipherSuite ALL:!DH:!EXPORT:!RC4:+HIGH:+MEDIUM:!LOW:!aNULL:!eNULL

  SSLCertificateFile ...
  SSLCertificateKeyFile ...
  Include /etc/letsencrypt/options-ssl-apache.conf

</VirtualHost>

I had been following the prescription given at How to configure multiple subdomain with SSL in Apache?

Path/Route Method

I had also tried exposing the app as a route path (ie https://example.com/blast)

  <Location /blast/ >
    ProxyPass http://localhost:4567/
    ProxyPassReverse http://localhost:4567/
  </Location>

but the reverse proxy didn't see to work in that, if I started with:

https://example.com/blast

And clicked whatever on the start page. The app would generate a internal URL without the /blast part, resulting in 404:

https://example.com/blah-blah-generated-url 
(should be https://example.com/blast/blah-blah-generated-url)

In general, the subdomain path seems to work better except for the non-https problem.

Answer 1

Setting up a path/route:

Making the application accessible with https://example.com/blast. If the application generates new routes, ProxyPassReverse is needed; otherwise; only ProxyPass is needed.

<VirtualHost *:443>
  ...
  ProxyPass "/blast/" "http://localhost:4567/"
  ProxyPassReverse "/blast/" "/"
  ...

Found in Example 1, here: ProxyPassReverse doesn't rewrite Location (http header)