Re: Mod_proxy and client certificate auth

[Paul D. Robertson]

On Wed, 7 Jun 2006, BJ Swope wrote:

> >From everything I've heard and read, mod-proxy will not proxy HTTPS on the
> back like what you are asking.  You can have HTTPS on the front end but not
> on the back.  It will have to be HTTP to the back.
> 
> If you get this working I would LOVE to hear how you got it done
> 
> 

I'm getting end-to-end SSL, just the undesired (this time) effect of 
having the client cert passed all the way through the chain, which I'd 
expect folks to want as normal behavior.

Paul
---------
Paul D. Robertson  "My statements in this message are personal opinions
[EMAIL PROTECTED]   which may have no basis whatsoever in fact."
http://fora.compuwar.net  Infosec discussion boards 

__
Apache Interface to OpenSSL (mod_ssl)   www.modssl.org
User Support Mailing List  modssl-users@modssl.org
Automated List Manager[EMAIL PROTECTED]

Mod_proxy and client certificate auth

[Paul D. Robertson]

Hi,

I'm trying to get mod_proxy to work as an SSL proxy using a client 
certificate on the proxy to connect to a backend IIS server that's set up 
to use any client certificate signed by my OpenSSL-based CA.  

If I use a browser with the same certificate bundled up as a PKCS12 
bundle, through the proxy, it all works, but what I really need is for 
Apache/mod_ssl to use a locally stored version of the cert/key to connect, 
then let the IIS server do its normal basic auth.  That's one single 
client cert/key for all externally connecting users (yes, I understand 
the ramifaction- it's not for user authentication,) not a per-user proxy 
cert.

Here's what I have in my Apache ssl.conf file:

RequestHeader set Front-End-Https "On"
CacheDisable *
SSLProxyEngine On
ProxyPass /app https://iisserver/app
ProxyPassReverse /app https://iisserver/app
SSLProxyMachineCertificatePath conf/cert
SSLEngine on

conf/cert contains user.pem, a .pem cert file with an RSA private key 
catenated to it.  I also have a hash link to the user.pem cert file.

Just in case, I've also added "export OPENSSL_ALLOW_PROXY_CERTS=1" to 
bin/envvars.

Can anyone tell me what I'm doing wrong?

Thanks,

Paul
---------
Paul D. Robertson  "My statements in this message are personal opinions
[EMAIL PROTECTED]   which may have no basis whatsoever in fact."

__
Apache Interface to OpenSSL (mod_ssl)   www.modssl.org
User Support Mailing List  modssl-users@modssl.org
Automated List Manager[EMAIL PROTECTED]