Topic: Apache reverse proxy to IIS - passing an x509 certificate

[Fiend]

Hello,

I have an Apache reverse proxy set up. I have an IIS server on the backend with a site which must be HTTPS and must require client certificates (x509). It seems like the proxy is working great, but the client certificate is not getting passed along the HTTPS request from proxy to IIS.

We keep getting 403.7 (Client certificate required) errors. Does anyone know how I can bridge the client certificate from Apache reverse proxy to IIS?

Our Apache proxy is not set up to require client certs, the IIS website is. What I would expect is that when we make a web request that goes through the proxy to the IIS server, that we would get challenged for a client cert for the IIS website (its set to require client certs like it always has) and that client cert information would be passed along the HTTPS request. We have to be able to programatically access the x509 cert through code on the IIS website, thats why we need to have the cert passed along.

[James Blond]

The easiest way is to configure the vhost you run as reverse proxy with SSL take the same certs you use in your IIS. That would it make also possible not to have SSL from apache to IIS (if wanted).

client<--->apache_with_ssl<--->IIS_with/out_SSL

[Fiend]

Thanks for the reply James. The problem I am having is that the .NET code on the server the proxy is directing to needs to programatically access the x509 cert that would be included in the HTTPS request.

I think what happens is that when a client makes a request to our backend server, an HTTPS connection is made to the proxy, then a new SSL connection is established from proxy to backend... causing the x509 cert to be lost from the original connection.

I need a way to retain that x509 cert from the original request in the second request that gets made from proxy to backend server.

[James Blond]

Well this might work with forwarding the headers.

example

[Steffen]

Remember, the reverse proxy is like a WEB client for the IIS server, don't need the certs or private keys from the internal Apache server, only the CA.

For configuring Apache, mod_proxy needs to know the Certification Authority (CA), wich signed the certificates from the remote webservers.

The directives are SSLProxyCACertificateFile , or SSLProxyCACertificatePath .

see:
http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslproxycacertificatefile
http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslproxycacertificatepath

In the mod_security handbook is also info found, with an example conf:

http://adolfomaltez.wordpress.com/2011/05/29/apache-reverse-proxy-modsecurity/


Steffen

[Fiend]

We are still getting nothing but 403.7 errors (SSL client certificate is required). Does anything look wrong or missing in our config? Also, I wanted to note again that the internal server behind the proxy is an IIS server not Apache.

[nel100]

Hi Fiend,
Have you solved this problem. I'm facing a similar problem.
Thanks

[needhelp101]

I have the same problem. Has anybody solved this?

My backend app is aspx and needs the client certs. I need a reverse proxy solution, apache or otherwise, which forwards the client cert to the backend IIS.

I have apache and IIS both requiring clients certs separately. I have the reverse proxy working with https. I am currently stuck trying to get the reverse proxy to forward client certs to IIS.

[wurstsalat]

Did anyone ever solve this issue?