I'm configuring an Apache SSL reverse proxy for calling a backend server, whose I have client certificates and keys, from a middleware. Shortly:
http https middleware -----------> proxy -------------> backend
The middleware doesn't even know about backend server, this is the trick of a reverse proxy.
I (think I) was able to operate the proxy beacuse I received a
AH02268: Proxy client certificate callback: (localhost:80) downstream server wanted client certificate but none are configured so I undestand that the proxy is trying to call the backend, but this last is complaining that the proxy is not passing him also the certificate.
So I miss to properly configure certificates. AFAIK I have to compile the section SSLCertificate * and SSLProxyMachineCertificate* of the
conf.d/modes-enabled/ssl.conf. I tried this way
SSLRandomSeed startup file:/dev/urandom 256 SSLRandomSeed connect builtin SSLEngine off SSLProxyEngine on SSLProtocol all # proxy SSLProxyMachineCertificateFile /usr/local/etc/apache2/ssl.crt/certificate.pem SSLProxyMachineCertificateChainFile /usr/local/etc/apache2/ssl.crt/chain.pem SSLProxyCACertificateFile /usr/local/etc/apache2/ssl.crt/ca.pem # certificate SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES SSLCertificateFile /usr/local/etc/apache2/ssl.crt/all.pem SSLCertificateChainFile /usr/local/etc/apache2/ssl.crt/certificate.pem # key SSLCertificateKeyFile /usr/local/etc/apache2/ssl.key/server.key SSLPassPhraseDialog exec:/usr/local/etc/apache2/pwf.sh
A few notes:
certificate.pemis the server certificate.
chain.pemis the intermediate chain of certificates, border excluded.
ca.pemis the Root CA certificate.
server.keyis the RSA private key
I replaced the normal dialog mode for entering the passaphrase with the pwf.sh script But I cannot even start apache because I have this message
AH02252: incomplete client cert configured for SSL proxy (missing or encrypted private key?) [ssl:emerg] [pid 12484]
AH02312: Fatal error initialising mod_ssl, exiting. AH00016: Configuration Failed
Now I read (sadly) that there's no way to overcome this problem because, as the apache.org site said, under all the SSLProxyMachine* directives:
(Currently there is no support for encrypted private keys)
Am I lost?