ssl - Issues with self-signed certificate behind an Apache reverse-proxy? -
i understand topic discussed in couple of older posts, will self-signed certificate work behind apache reverse-proxy? posted @ryan
i facing same issue unable around it. have apache 2.4.12 setup reverse proxy in front of oracle http server. have valid certs on proxy server self signed certs on oracle http server. goal https way through, whenever browser gets myhost.domain, throws cert warning(because of self signed certs). having authentic certs on oracle http server not option , users browsers restricted , hence cannot ignore self signed cert warning.
here's virtual host
loglevel error servername myhost.domain serveralias xxx.xxx.xxx.xx documentroot d:/xyz/pubdocs sslengine on sslproxyengine on sslcertificatefile certs/myserver.crt sslcertificatekeyfile certs/myserver.key sslcertificatechainfile certs/myserver_chain.crt sslproxycacertificatefile certs/my_self_signed.pem sslproxyverify none sslproxycheckpeername off sslproxycheckpeercn off sslproxycheckpeerexpire off sslprotocol -all +tlsv1 sslproxyprotocol +sslv3 +tlsv1 +tlsv1.1 #sslciphersuite all:!anull:!adh:!enull:!low:!exp:!null:rc4+rsa:+high:+medium errorlog "logs/abc-error.log" customlog "logs/abc-access.log" cert proxyrequests off # ie compatibility header set x-ua-compatible "ie=emulateie8" # prevent page being loaded within iframe (cross-frame scripting protection) header append x-frame-options sameorigin # prevent mime sniffing exploint ; disabled breaks pem popup image rendering # header set x-content-type-options: nosniff # disable caching header set cache-control "no-cache, must-revalidate, private" # enable x-xss-protection header set x-xss-protection: "1; mode=block" proxypass / https://myhost.domain/ proxypassreverse / https://myhost.domain/
it seems using following directives worked many people, doesnt seem work me
sslproxyverify none
sslproxycheckpeername off
sslproxycheckpeercn off
sslproxycheckpeerexpire off
is there else missing.
any appreciated.
thanks, raj
Comments
Post a Comment