Monday, July 6, 2015

centos - Apache not proxying HTTPS requests to tomcat

Centos 7, Apache 2.4, TomCat 7.0.52, Java 1.7



I am trying to configure Apache to proxy a tomcat server (running Jira / Confluence) using HTTPS:



(HTTPS:443) -> ApacheServer -> (HTTP:8090 or HTTPS:8091) TomCat



Currently HTTP proxying works perfectly but I want to get HTTPS working. I dont mind if the connection between Apache and Tomcat is SSL (on the same server).




When I visit https://confluence.company.co.uk/ I get /var/www/html/index.html rather than the proxy.



Here is the Server.xml from tomcat:



           maxThreads="200" minSpareThreads="10"
enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8" />


connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false"
maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" protocol="HTTP/1.1"
redirectPort="8443" useBodyEncodingForURI="true" scheme="https" secure="true" />


Lines changed from default /etc/httpd/conf.d/ssl.conf from Apache:



ServerName confluence.company.co.uk:443
SSLCertificateFile /etc/pki/tls/certs/company.pem
SSLCertificateKeyFile /etc/pki/tls/private/company.key



Apache VHost Configuration ( in /etc/httpd/conf.d/proxy_vhost.conf ):




ServerName confluence.company.co.uk
ProxyRequests Off

Order deny,allow
Deny from all

Allow from all


AuthType Basic
AuthName "Proxy Auth"
AuthUserFile /var/www/company-auth/CONFLUENCE/.htpasswd
Require user ukuser
Satisfy any
Deny from all
Allow from 192.168.0.0/21


ProxyPreserveHost On
ProxyPass / http://confluence.company.co.uk:8090/
ProxyPassReverse / http://confluence.company.co.uk:8090/


SSLProxyEngine On
ProxyRequests Off

Order deny,allow

Deny from all
Allow from all

ProxyPreserveHost On
ProxyPass / https://confluence.company.co.uk:8091/
ProxyPassReverse / https://confluence.company.co.uk:8091/

No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...