Error during SSL Handshake with remote server

138
votes

I have Apache2 (listening on 443) and a web app running on Tomcat7 (listening on 8443) on Ubuntu.

I set apache2 as reverse proxy so that I access the web app through port 443 instead of 8443. Besides, I need to have SSL communication not only between browser and apache2 but also between apache2 and tomcat7, thus I set SSL on both apache2 and tomcat7. If I try to access the web app by directly contacting tomcat7, everything is fine. The problem is that when I try to access the tomcat's web app through apache2 (reverse proxy), on the browser appears the error:

Proxy Error
The proxy server could not handle the request GET /web_app.
Reason: Error during SSL Handshake with remote server
4
apachetomcatsslreverse-proxy
Apache does not truest the certificate you have installed on the tomcat. Is it a self-signed cert? Or is it made by an in-house CA? - MK.
It is self signed with this command: openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt - user2791481
serverfault.com/questions/356678/… I think this is what you want: SSLProxyVerify none SSLProxyCheckPeerCN off - MK.
Better to set SSLProxyCACertificateFile to your private CA certicate, instead of just turning off verification. - ndbroadbent
as explained in this blog you can turn off the SSL checks. - HybrisHelp

4 Answers

307
votes

The comment by MK pointed me in the right direction.

In the case of Apache 2.4 and up, there are different defaults and a new directive.

I am running Apache 2.4.6, and I had to add the following directives to get it working:

SSLProxyEngine on
SSLProxyVerify none 
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
4
votes

I have 2 servers setup on docker, reverse proxy & web server. This error started happening for all my websites all of a sudden after 1 year. When setting up earlier, I generated a self signed certificate on the web server.

So, I had to generate the SSL certificate again and it started working...

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ssl.key -out ssl.crt

2
votes

Faced the same problem as OP:

  • Tomcat returned response when accessing directly via SOAP UI
  • Didn't load html files
  • When used Apache properties mentioned by the previous answer, web-page appeared but AngularJS couldn't get HTTP response

Tomcat SSL certificate was expired while a browser showed it as secure - Apache certificate was far from expiration. Updating Tomcat KeyStore file solved the problem.

0
votes

On a remote OEL (Oracle Enterprise Linux) 7.8 server, i have a backend web application running with HTTPS/8009. As its a third party app, I did not have choice to disable SSL or change port.

As i needed to access the web app from my local machine's browser, i thought of setting up a reverse proxy (HTTP to HTTPS mapping) using Apache httpd. Now i can access the web app from my local browser through below URL:

http://10.157.146.97:1234/

FYI, CURL commands working inside the Linux Machine were below ones:

curl http://10.157.146.97:1234/
curl -k https://localhost:8009/

Here is my reverse proxy setup :

/etc/httpd/conf/httpd.conf

Listen 1234

<VirtualHost *:1234>
SSLProxyEngine On
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
ProxyPreserveHost On
ProxyPass / https://localhost:8009/
ProxyPassReverse / https://localhost:8009/
</VirtualHost>

One aspect i struggled a lot, earlier i was trying with url pattern (/sample) in ProxyPass/ProxyPassReverse but that was causing HTTP 404 (not found) for css/js files as web-app's welcome page contains indirect css/js paths (sample code below). So replacing url pattern (/sample) with (/) solved that problem too.

previous Not working config:
ProxyPass /sample https://localhost:8009/
ProxyPassReverse /sample https://localhost:8009/

<script defer src="abc.js"></script><link href="xyz.css" rel="stylesheet"></head>