Apache httpd ProxyPass to SSL enabled tomcat 抛出“此站点的连接不安全”

Apache httpd ProxyPass to SSL enabled tomcat throws "connection for this site is not secure"

提问人:vinayawsm 提问时间:8/16/2023 最后编辑:vinayawsm 更新时间:8/16/2023 访问量:27

问:

我有一台运行 Apache httpd 服务的服务器(在端口 8000 上),该服务器配置了 ProxyPass 规则,以根据用户所在的域将用户流量重定向到不同的服务器。当用户提出请求时,他们的请求将被重定向到我运行 tomcat Web 应用程序的位置。同样,如果用户正在请求,则会重定向到运行其他 tomcat Web 应用程序的位置。domain1.com123.45.67.89:8444domain2.com123.45.67.90:8444

我的virtualhost.conf文件看起来像这样

<VirtualHost *:8000>
    ServerName domain1.com

    ProxyPreserveHost On
    SSLProxyEngine on
    SSLCertificateFile /app/certs/domain1.com.crt
    SSLCertificateKeyFile /app/certs/domain1.com.key
    SSLCertificateChainFile /app/certs/domain1.com.pem

    ProxyPass             / https://123.45.67.89:8444/ connectiontimeout=300 timeout=300
    ProxyPassReverse      / https://123.45.67.89:8444/
</VirtualHost>

<VirtualHost *:8000>
    ServerName domain2.com

    ProxyPreserveHost On
    SSLProxyEngine on
    SSLCertificateFile /app/certs/domain2.com.crt
    SSLCertificateKeyFile /app/certs/domain2.com.key
    SSLCertificateChainFile /app/certs/domain2.com.pem

    ProxyPass             / https://123.45.67.90:8444/ connectiontimeout=300 timeout=300
    ProxyPassReverse      / https://123.45.67.90:8444/
</VirtualHost>

我的 tomcat 服务器上的端口 8444 启用了 SSL,并且在两个 tomcat 服务器上看起来与此类似server.xml

<Connector port="8080" protocol="HTTP/1.1"
   connectionTimeout="20000"
   redirectPort="8444" />

<Connector port="8444"
   protocol="HTTP/1.1"
   SSLEnabled="true"
   maxThreads="300"
   scheme="https"
   secure="true"
   keystoreType="JKS"
   keystoreFile="/app/conf/key/identity.jks"
   keystorePass="${KEYSTORE_PASS}"
   truststoreFile="/app/conf/key/truststore.jks"
   truststorePass="${TRUSTSTORE_PASS}"
   clientAuth="false"
   sslProtocol="TLS"
   sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
   ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, <multiple-ciphers follows>"

当我访问或时,他们会在浏览器上显示“此站点的连接不安全”() 消息。如果有人能指出我的方法或实施中的任何错误,我们将不胜感激。domain1.com/domain2.com/ERR_SSL_PROTOCOL_ERROR

Apache SSL Tomcat 虚拟主机 代理

评论


答:

0赞 vinayawsm 8/16/2023 #1

我必须添加 VirtualHost 块才能在 Apache Server 上的传入流量上启用 SSL。这解决了 .我的最终 VirtualHost 配置如下所示SSLEngine onERR_SSL_PROTOCOL_ERROR

<VirtualHost *:8000>
    ServerName domain1.com

    ProxyPreserveHost On
    SSLProxyEngine on
    SSLEngine on
    SSLCertificateFile /app/certs/domain1.com.crt
    SSLCertificateKeyFile /app/certs/domain1.com.key
    SSLCertificateChainFile /app/certs/domain1.com.pem

    ProxyPass             / https://123.45.67.89:8444/ connectiontimeout=300 timeout=300
    ProxyPassReverse      / https://123.45.67.89:8444/
</VirtualHost>