We have a web application hosted on Tomcat server (clustered), with two Apache web servers sitting in front and F5 load balance5 in front of apache. SSL is configured in F5 load balancer. Now whenever someone accesses our application using the load balancer's secure url, our java web application does not evaluate request.isSecure to be true. Is there any setting I need to do enable this.
In our apache web server we have the following configuration using proxy balancer
ServerName ip:80
ProxyPass /balancer-manager !
ProxyPass / balancer://mycluster/ stickysession=JSESSIONID nofailover=Off
ProxyPassReverse / balancer://mycluster/
<Proxy balancer://mycluster>
BalancerMember ajp://ipapp1:8009 route=jvm1 loadfactor=1
BalancerMember ajp://ipapp2:8009 route=jvm2 loadfactor=1 status=+H
ProxySet lbmethod=byrequests
</Proxy>
I tried to change the connector details in server.xml of tomcat by adding scheme= "https", secure="true" and proxyPort="443" for 8080 but it did not work.
What am I missing here?
You'd need to check your app to see if it is supported, but typically a header is forwarded communicating the request protocol. Traditionally this was the X-Forwarded-Proto header, but X-... nomenclature has been deprecated. The Forwarded header now supports what was X-Forwarded-For, X-Forwarded-Proto, etc... in one header. There is still wide support for the deprecated method however, so either approach should work pending app support.
X-Forwarded-Proto: https
or
Forwarded: proto=https
The new standards are described in RFC 7239
Maybe I'm a bit late here, but I had the same situation. I added
scheme= "https", secure="true" and proxyPort="443"
on port 8009 , not on port 8080 like the original question. That's because from Apache the request is made via AJP on port 8009.
Also, Apache must have http-ssl.conf enabled from http.conf and it has to be listening on port 443.
I tried this configuration and it worked, the request sent through the Load Balancer in front of the Apache reported the tomcat webapp in https correctly.
I hope this helps who has the same problem, it took me days to understand this.
Related
I've read a lot of questions and answers which seem exactly the same as mine, but I can't seem to get my setup to work. I have a VM running Apache with only HTTP support at 192.168.2.101:32773. I can access it on my local network as such just fine. I now am ready to expose it through my Apache web server that has Lets Encrypt setup to generate SSL certificates. So I added this to my server conf file:
<VirtualHost *:32773>
ServerName server.com
SSLEngine on
SSLProxyEngine On
SSLCertificateFile /etc/letsencrypt/live/server.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/server.com/privkey.pem
ProxyRequests Off
ProxyPreserveHost On
ProxyPass / http://192.168.2.101:32773/
ProxyPassReverse / http://192.168.2.101:32773/
</VirtualHost>
However, I get an ERR_SSL_PROTOCOL_ERROR when I try to load it up as https://server.com:32773. If I however change my address to http://server.com:32773, it loads just fine. Anything look wrong in this snippet? Thanks!
HTTP and HTTPS need to be on different ports. Typically HTTPS is served on port 443.
This is embarrassing... At some point I changed my port forward rules to point 32773 directly to 192.168.2.101 so I could validate that the rules were working at all. The above config worked as soon as I realized I wasn't even sending traffic to my Apache SSL enabled server.
I have configured an Apache http server with mod_proxy to load balance between two jetty servers (sticky sessions).
Everything works fine and as expected while the two servers are up and running. But if I get one of the servers down and then attempt to make an http post to that server, the Apache balancer redirects the post to the running server but with an empty body, losing the original request.
After the request that triggered the redirect to the running server, all subsequent requests work fine.
Apache configuration:
<Proxy balancer://cluster>
BalancerMember http://localhost:9090 route=node1
BalancerMember http://localhost:9091 route=node2
ProxySet stickysession=JSESSIONID
</Proxy>
ProxyPreserveHost On
ProxyPass "/" "balancer://cluster/"
ProxyPassReverse "/" "balancer://cluster/"
I'm using Apache Server 2.4 and Jetty 9.4.22
Any ideas on why this is happening?
Thanks.
It looks like you hit the bug introduced as a regression in 2.4.41. You can check out the details here: https://bz.apache.org/bugzilla/show_bug.cgi?id=63891
To remedy, you will need to upgrade to 2.4.42 or greater.
My configuration is as follows - 1 unix server with two http servers running at the same time:
apache server on ports 80 and 443
Nginx server on port 8200 (www.myserver.com:8200)
The problem is that when I log in to Nginx site I need to authorize there. Doing this over internet with no SSL is not wise... I would like to connect to my apache server with SSL, be transparently redirected to another site and authorize still having encrpyted connection.
Nginx works via http so no ssl there... I would like to have url
https://www.myserver.com/duplicati to be proxied to http://www.myserver.com:8200
Effectively I want to have:
encrypted connection from the web client to www.myserver.com
proxy connection from https://www.myserver.com/duplicati to http://www.myserver.com:8200 (unencrypted), but limited to 1 physical machine which I don't care much about encryption (or actually lack of it)
What I did was the following
What I did was the following Apache config:
ProxyRequests Off
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyPass /duplicati/ http://127.0.0.1:8200/ngax/
ProxyPassReverse /duplicati/ http://127.0.0.1:8200/ngax/
<Location /duplicati/>
ProxyPassReverse /
Order deny,allow
Allow from all
</Location>
Header edit Location ^http://127.0.0.1:8200/ngax/ https://127.0.0.1:8200/ngax/
still no luck with that config....
It looks like a simple thing to do but after 5h of struggle I need to send my very first post to Stackoverflow community ;-)
Could you kindly help me with it?
I keep running into an issue with Apache's mod_proxy where it won't forward any traffic. I'm using a Windows Azure virtual machine running Ubuntu 13.04 and have configured the proper HTTPS endpoint (port 443) for it. The proper Apache modules (proxy, ssl, etc.) are all installed, and the error logs show nothing, not even a warning to explain why this is happening. My VirtualHost setup is as follows:
<VirtualHost *:443>
RequestHeader set X-Forwarded-Proto "https"
ProxyPreserveHost On
ServerName www.example.com
SSLEngine On
#SSLProxyEngine On
SSLCertificateFile /ssl/my.com.crt
SSLCertificateKeyFile /ssl/my.key
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
<Location />
SSLRequireSSL
Order deny,allow
Allow from all
</Location>
ProxyPass / http://127.0.0.1:8080/
ProxyPassReverse / http://127.0.0.1:8080/
</VirtualHost>
I have Listen 443 and NameVirtualHost *:443 all set as well. My service on the other port is running fine as doing a wget responds with an HTTP 200 OK response and I can reach it by manually inputting the port number. I have disabled all firewalls (for testing) to no avail as well. However, whenever I try to reach the service from the outside world through mod_proxy (port 443), the request times out and I get the usual "website not available" browser error.
If it means anything, the app I am running on the other port I need to forward HTTPS traffic to is a Play Framework 2.1 application. I set the server up exactly as in their documentation but still have these problems, so I'm assuming it may have something to do with Azure.
Any ideas? Is there some other type of endpoint configuration that I need to do specific for Windows Azure virtual machines to support SSL/TLS?
So, apparently, I have no idea how or why - but the Azure Gods decided to shine upon my setup all of a sudden. Overnight, without so much as a reboot or anything, mod_proxy on Azure just started working. I have no idea what the issue was, or even if there was one in the first place, but apparently the problem lies with something in the Azure infrastructure.
Sorry I couldn't be of more help for others encountering similar issues, but just giving it time worked for some unknown reason.
I have apache tomcat application which is configured to apache webserver, now I want to add another apache tomcat application to same Apache web server,all these servers (apache tomcat and apache web server (rhel)) are on same network, kindly provide me some ways for configuring it.
is there any other way without using mod_jk?
Apache can talk to Tomcat using either mod_jk or by using the standard proxy module, mod_proxy. Using the standard proxy module, it's very easy to put multiple instances of Tomcat behind a single Apache instance.
Assuming that you have a Tomcat instance listening on port 8080 and another on port 8081, you can do something as simple as this:
<Location /app1/>
ProxyPass http://localhost:8080/
ProxyPassReverse http://localhost:8080/
</Location>
<Location /app2/>
ProxyPass http://localhost:8081/
ProxyPassReverse http://localhost:8081/
</Location>
This places the first instance at /app1/ and the second instance at
/app2/.
The mod_proxy documentation is a good place to start, and the tomcat documentation covers this topic briefly.