Topic: Reverse Proxy to a internal website hosted on Windows 2008

[impeeza]

1. Problem:
Until now I am running a Reverse Proxy service on a Windows 2022 server, running Apache Haus httpd-2.4.55-o111s-x64-vs17.zip (Built using C sources from the ASF and OpenSSL on Visual Studio 2022 (VS17).)
With the next modifications to default Config Files:
1.1. \conf\httpd.conf

First enabled the next modules removing comment to:

[impeeza]

I just create a parallel setup to make tests, and discover what using the same version of Apache Haus but the OpenSSL 3 version (Apache 2.4.x OpenSSL 3.0.x VS17) I have the same problem, so is something about OpenSSL.

On OpenSSL 1 the Windows 2008 SSl site can be proxied without problem, but OpenSSL3 have the «Error during SSL Handshake with remote server».

Any Toughs?

There is a Apache Lounge version using OpenSSl 1?

Thanks.

[tangent]

Believe your problem lies in the fact your internal server doesn't support anything later than TLSv1, as shown by your Internal Site SSL Analysis.

SSLv2 offered (NOT ok), also VULNERABLE to DROWN attack -- 2 ciphers
SSLv3 offered (NOT ok)
TLS 1 offered (deprecated)
TLS 1.1 not offered
TLS 1.2 not offered and downgraded to a weaker protocol
TLS 1.3 not offered and downgraded to a weaker protocol
NPN/SPDY not offered
ALPN/HTTP2 not offered

OpenSSL v3 defaults to Security Level 1, and these days TLS 1 is classed as Security Level 0.

There are a few posts on this site that pick up on this issue, notably https://www.apachelounge.com/viewtopic.php?t=9083 and workaround https://www.apachelounge.com/viewtopic.php?p=41572.

However, if you set your openssl.conf file to allow security level 0, you'll need to need to tighten up and manage the SSL protocol and cipher options on your site front end, as much as specifying what SSL protocols and ciphers to use with the backend connection (SSLProxyProtocol and SSLProxyCipherSuite).

As far as your front end is concerned, there are a number of posts from moderator James Blond where he describes recommended SSL configuration options, e.g. https://www.apachelounge.com/viewtopic.php?t=9180

Realistically, in the limit, you need to get your internal site upgraded to support more recent SSL protocol standards.

[impeeza]

Thanks a lot, you are completely right, Windows Server 2008 only support TLS 1.0 and NEVER will support any new.

The migration project for that server will take 1 or 2 years more, the quirks of legacy software!

So my Workaround was: on the virtual host proxy definition changed the PROXYPASS directive to INTERNALLY use HTTP and externally only uses HTTPS, so the external clients only can use the HTTPS front end of the Apache server and Apache communicate using HTTP with the internal server.

The only drawback is that communication becomes vulnerable for a MiTM attack but that is only on the internal servers network so is an almost impossible scenery because is inside protected data-center.

Thanks a lot for taking the time to answer.