Mailing List Archive: Apache: Users

Problem with Apache + Tomcat + SSL + mod_rewrite

Index | Next | Previous | View Threaded

tom at ukmn

Jan 18, 2007, 3:25 AM

Post #1 of 3 (384 views)
Permalink

Problem with Apache + Tomcat + SSL + mod_rewrite

Could anyone help me with a problem I have using mod_rewrite to send an https
request from apache to tomcat. I have a couple of questions:
Does my working rule (below) break the security imposed by SSL by
redirecting to port 8080?
Why does my rewrite rule to the ssl port on tomcat fail?

In this example the tomcat application name is the same as the subdomain
name.

My current rewrite rule that works is:

RewriteCond %{THE_REQUEST} "^(GET|POST) https://.*"
RewriteRule ^/(.*) https://localhost:80/ [F,L]
RewriteCond %{REQUEST_URI} "!^/sub_domain_name/.*"
RewriteRule ^/(.*) http://localhost:8080/sub_domain_name/$1 [P]
RewriteCond %{REQUEST_URI} ^/sub_domain_name/.*
RewriteRule ^/(.*) http://localhost:8080/$1 [P]

Since port 8080 is not secure I have tried the following, but it does not
work:

RewriteCond %{REQUEST_URI} "!^/sub_domain_name/.*"
RewriteRule ^/(.*) https://localhost:8444/sub_domain_name/$1 [P]
RewriteCond %{REQUEST_URI} ^/sub_domain_name/.*
RewriteRule ^/(.*) https://localhost:8444/$1 [P]

https is on 8444 rather than 8443 because a plesk system is running on 8443.
The tomcat certificate has been generated and the server.xml modified.
Tomcat is happy serving pages on https://localhost:8444 directly so why
would this rewrite rule fail?

The mod_rewrite log has the same output (except for the urls used in the
rewrite) for both of these rules, so thats no help.
the ssl_error log says:
RSA server certificate CommonName (CN) `localhost.localdomain' does NOT
match server name!?
the error_log has a similar warning:
[warn] RSA server certificate CommonName (CN) `plesk' does NOT match server
name!?
--
View this message in context: http://www.nabble.com/Problem-with-Apache-%2B-Tomcat-%2B-SSL-%2B-mod_rewrite-tf3033654.html#a8429080
Sent from the Apache HTTP Server - Users mailing list archive at Nabble.com.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

sergeyfd at gmail

Jan 18, 2007, 6:54 AM

Post #2 of 3 (353 views)
Permalink

Re: Problem with Apache + Tomcat + SSL + mod_rewrite [In reply to]

It would be good to take a look at you Tomcat's server.xml (connectors
part) file as well. Without that it's hard to answer your questions.
Bu there are some answers:

On 1/18/07, Tomo <tom [at] ukmn> wrote:
>
> Could anyone help me with a problem I have using mod_rewrite to send an https
> request from apache to tomcat. I have a couple of questions:
> Does my working rule (below) break the security imposed by SSL by
> redirecting to port 8080?

No if your Tomcat is configured to listen on 127.0.0.1 address only.

> Why does my rewrite rule to the ssl port on tomcat fail?

Hard to tell. Need to see connectors config.

>
> In this example the tomcat application name is the same as the subdomain
> name.
>
> My current rewrite rule that works is:
>
> RewriteCond %{THE_REQUEST} "^(GET|POST) https://.*"
> RewriteRule ^/(.*) https://localhost:80/ [F,L]
> RewriteCond %{REQUEST_URI} "!^/sub_domain_name/.*"
> RewriteRule ^/(.*) http://localhost:8080/sub_domain_name/$1 [P]
> RewriteCond %{REQUEST_URI} ^/sub_domain_name/.*
> RewriteRule ^/(.*) http://localhost:8080/$1 [P]
>
> Since port 8080 is not secure I have tried the following, but it does not
> work:
>
> RewriteCond %{REQUEST_URI} "!^/sub_domain_name/.*"
> RewriteRule ^/(.*) https://localhost:8444/sub_domain_name/$1 [P]
> RewriteCond %{REQUEST_URI} ^/sub_domain_name/.*
> RewriteRule ^/(.*) https://localhost:8444/$1 [P]
>
> https is on 8444 rather than 8443 because a plesk system is running on 8443.
> The tomcat certificate has been generated and the server.xml modified.
> Tomcat is happy serving pages on https://localhost:8444 directly so why
> would this rewrite rule fail?

What do you mean by "fail". Do you get 501 error or something else?

>
> The mod_rewrite log has the same output (except for the urls used in the
> rewrite) for both of these rules, so thats no help.
> the ssl_error log says:
> RSA server certificate CommonName (CN) `localhost.localdomain' does NOT
> match server name!?
> the error_log has a similar warning:
> [warn] RSA server certificate CommonName (CN) `plesk' does NOT match server
> name!?

How did you generate a certificate for Tomcat? Is it self-signed or a
real one? For what server that cert was generated?

> --
> View this message in context: http://www.nabble.com/Problem-with-Apache-%2B-Tomcat-%2B-SSL-%2B-mod_rewrite-tf3033654.html#a8429080
> Sent from the Apache HTTP Server - Users mailing list archive at Nabble.com.
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe [at] httpd
> " from the digest: users-digest-unsubscribe [at] httpd
> For additional commands, e-mail: users-help [at] httpd
>
>

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

krist.vanbesien at gmail

Jan 18, 2007, 7:10 AM

Post #3 of 3 (365 views)
Permalink

Re: Problem with Apache + Tomcat + SSL + mod_rewrite [In reply to]

On 1/18/07, Tomo <tom [at] ukmn> wrote:

> https is on 8444 rather than 8443 because a plesk system is running on 8443.
> The tomcat certificate has been generated and the server.xml modified.
> Tomcat is happy serving pages on https://localhost:8444 directly so why
> would this rewrite rule fail?
>
> The mod_rewrite log has the same output (except for the urls used in the
> rewrite) for both of these rules, so thats no help.
> the ssl_error log says:
> RSA server certificate CommonName (CN) `localhost.localdomain' does NOT
> match server name!?
> the error_log has a similar warning:
> [warn] RSA server certificate CommonName (CN) `plesk' does NOT match server
> name!?

When you connect to https://localhost:8444/ using a browser you
probably get a dialog box saying that the browser can't verify the
certificate, asking you if you want to accept the session anyway. And
I asume you click on OK then.

This is because you have a self signed cert on your tomcat server.

The problem is that when your apache server makes a https connection
with the tomcat server there is nobody around to click on "ok". So
apache, when it encounters errors in the certificate (which it does
when it is self signed) will just refuse the connection.

In this case I would really reconsider if ssl is really necessary. If
the only way the tomcat application is accesses is via the apache
server, than you don't need ssl. You can just use http for your
tomcat. It is quite common in prodcution environments (e.g. ours) that
ssl is terminated on an apache server, and than forwarded over http to
the tomcat server.

The only solution I can see if you really want https between your
apache and tomcat servers, you will need to do the following:

- Get a proper certificate. You can get one for free at cacert.org or
you can set up your own CA (which is what I did). You then need to
integrate the root certificate in to the CA store of your apache
server, so it can verify the cert. For this I refer you to the apache
documentation.

Krist

--
krist.vanbesien [at] gmail
Bremgarten b. Bern, Switzerland
--
"...what you don't realize is that in the future Google WILL reach
sentience, will [have had] invent[ed] a time machine, and will [have
had] travel[ed] back in time to prevent Bill Gates... only to become
Bill Gates by accident because of a search engine optimization
miscalculation." (Comment on the Dilbert Blog)

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads