无法配置apache服务器以代理SSL连接

Question

我正在使用Apache Portable Runtime运行Tomcat7上的应用程序,我购买了SSL证书并正确配置 - 当我尝试通过ip:端口组合连接时,它连接正常但警告我证书是发给域名的,不是知识产权.

我所使用的VPS没有SELinux(并且安装时出现问题),这是AFAIK要求在apache中配置SSL所需的,所以我想将请求路由到Tomcat,Tomcat就是这样做的.

我将apache配置为代理连接,首先是端口80完美运行:

NameVirtualHost www.mysite.com:80
<VirtualHost www.mysite.com:80>
ProxyPreserveHost On
ProxyRequests Off
ServerName http://www.mysite.com
ServerAlias http://www.mysite.com
ProxyPass / http://localhost:8180/MYSITE/
ProxyPassReverse / http://localhost:8180/MYSITE/
ProxyPassReverseCookiePath /MYSITE/ /
</VirtualHost>

然后使用不想因某些原因工作的SSL端口:

NameVirtualHost www.mysite.com:443
<VirtualHost www.mysite.com:443>
        SSLProxyEngine On
        ProxyPreserveHost On
        ProxyRequests Off
        ServerName https://www.mysite.com
        ServerAlias https://www.mysite.com
        ProxyPass / https://localhost:8443/MYSITE/
        ProxyPassReverse / https://localhost:8443/MYSITE/
        ProxyPassReverseCookiePath /MYSITE/ /
        CacheDisable *
</VirtualHost>

编辑:我添加了

RequestHeader set Front-End-Https "On"

指向VirtualHost www.mysite.com:443的指令,见:http://www.gossamer-threads.com/lists/apache/users/396577

这是在Tomcat的server.xml中配置的Tomcat APR连接器 -

<Connector port="8443" maxHttpHeaderSize="16500"
                 maxThreads="150"
                 enableLookups="false" disableUploadTimeout="true"
                 acceptCount="100" scheme="https" secure="true"
                 SSLEnabled="true"
                 SSLCertificateFile="x509-cert-path"
                 SSLCertificateKeyFile="key-file-path"
 />

没有错误/警告启用虚拟主机并重新启动Apache.当我尝试https时,这就是我在FFox中​​看到的:

SSL received a record that exceeded the maximum permissible length.

(Error code: ssl_error_rx_record_too_long)

在Chromium:

Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error.

Apache的error.log显示此警告消息:

[warn] [client 216.58.38.90] proxy: no HTTP 0.9 request (with no host line) on incoming request and preserve host set forcing hostname to be www.mysite.com for uri /

我花了几天时间尝试配置它,如果有人解释了发生了什么以及如何解决它,我将非常感激.

非常感谢.胜利者.

Answer 1

您不需要Tomcat中的8443 HTTPS连接器.Apache HTTPD应终止SSL连接,并通过ProxyPass / http://localhost:8080/MYSITE/.纯文本HTTP连接器向Tomcat说纯文本port=8080,address=127.0.0.1因此没有外人可以使用它.

更好的是,不要在Tomcat中使用任何HTTP连接器,只需要一个AJP连接器address=127.0.0.1,并在Apache中使用mod_proxy_ajp.