I'm configuring an Apache SSL reverse proxy for calling a backend server, whose I have client certificates and keys, from a middleware. Shortly:

               http               https
middleware -----------> proxy -------------> backend

The middleware doesn't even know about backend server, this is the trick of a reverse proxy.

I (think I) was able to operate the proxy beacuse I received a

AH02268: Proxy client certificate callback: (localhost:80) downstream server wanted client certificate but none are configured so I undestand that the proxy is trying to call the backend, but this last is complaining that the proxy is not passing him also the certificate.

So I miss to properly configure certificates. AFAIK I have to compile the section SSLCertificate * and SSLProxyMachineCertificate* of the conf.d/modes-enabled/ssl.conf. I tried this way

SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLEngine off
SSLProxyEngine on
SSLProtocol all

# proxy
SSLProxyMachineCertificateFile /usr/local/etc/apache2/ssl.crt/certificate.pem
SSLProxyMachineCertificateChainFile /usr/local/etc/apache2/ssl.crt/chain.pem
SSLProxyCACertificateFile /usr/local/etc/apache2/ssl.crt/ca.pem

# certificate
SSLCertificateFile /usr/local/etc/apache2/ssl.crt/all.pem
SSLCertificateChainFile /usr/local/etc/apache2/ssl.crt/certificate.pem

# key
SSLCertificateKeyFile /usr/local/etc/apache2/ssl.key/server.key
SSLPassPhraseDialog  exec:/usr/local/etc/apache2/pwf.sh

A few notes:

  • certificate.pem is the server certificate.
  • chain.pem is the intermediate chain of certificates, border excluded.
  • ca.pem is the Root CA certificate.
  • server.key is the RSA private key

I replaced the normal dialog mode for entering the passaphrase with the pwf.sh script But I cannot even start apache because I have this message

AH02252: incomplete client cert configured for SSL proxy (missing or encrypted private key?) [ssl:emerg] [pid 12484]
AH02312: Fatal error initialising mod_ssl, exiting. AH00016: Configuration Failed

Now I read (sadly) that there's no way to overcome this problem because, as the apache.org site said, under all the SSLProxyMachine* directives:

(Currently there is no support for encrypted private keys)

Am I lost?

1 Answer 1


You already realized yourself that there is no support for encrypted private keys. If you insist on using encrypted private keys you are lost. If it is acceptable to provide the private key in plain do this. To convert the encrypted private key into a plain key use (for RSA keys)

  openssl rsa -in encrypted_key.pem -out decrypted_key.pem
  • Thanks. Not my choice. Customer gave me the bundle with private key and said me "It's up to you". Anyway I already did that enadeavour and the problem remains.
    – Marco
    Jun 15, 2020 at 8:46
  • @Marco: "Anyway I already did that enadeavour and the problem remains." - then you did it wrong. Sorry, but impossible to help you with more detail on what exactly you did wrong due to a lack of details what exactly you did. Jun 15, 2020 at 14:03
  • No, sorry. Maybe I didn't exactly this operation and dint't work.
    – Marco
    Jun 15, 2020 at 16:18
  • No, sorry. Maybe I didn't exactly this operation, at the time, and that dint't work. But I discovered there was more than one problem on how I put together the client certificate starting from the pkcs#12 file, and one was the RSA private key. Anyway your suggestion has been useful to get out of the impasse. Thanks!
    – Marco
    Jun 15, 2020 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.