ProxyPreserveHost doesn't work with SSL

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Dear all,

I'm reverse proxying requests on Apache/2.4.18 (stock version on Ubuntu 16.04) via SSL to an application running on IIS 7.0. Somehow, despite ProxyPreserveHost, IIS app manages to sniff IP-address 10.1.2.3 specified in ProxyPass (see below) and breaks. If I replace 10.1.2.3 with myapp.com and put "10.1.2.3 myapp.com" in /etc/hosts everything works (but I don't like the solution).

Because of SSL the problem is somewhat hard to debug, can't just packet trace. I tried to replace IIS application with CGI script on different Apache, without SSL, and found that ProxyPreserveHost is not ignored (environment variable SERVER_NAME set correctly to myapp.com). I guess for SSL the ProxyPreserveHost is implemented partially, i.e. for Host header but not for SNI. Any ideas on how to investigate?

Here's the complete virtualhost configuration:
---
<VirtualHost *:443>
    ServerName myapp.com

    SSLEngine on
    SSLCertificateFile  /etc/ssl/certs/myapp.pem
    SSLCertificateKeyFile /etc/ssl/private/myapp.key

    SSLProxyEngine on
    SSLProxyProtocol all
    SSLProxyCipherSuite ALL
    SSLProxyVerify none
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off

    <Location />
        ProxyPreserveHost on
        ProxyPass https://10.1.2.3/ connectiontimeout=300 timeout=300
        ProxyPassReverse /
        ProxyPassReverseCookieDomain myapp.com 10.1.2.3
    </Location>
</VirtualHost>
---

--

With Best Regards,
Marat Khalili

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx




[Index of Archives]     [Open SSH Users]     [Linux ACPI]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Squid]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]

  Powered by Linux