I'm trying to set up an Apache Forward Proxy that terminates the SSL connection. The reason I'm trying to do this is to run Apache filters (specifically mod_pagespeed) on the returned code. Before I deal with mod_pagespeed, I'm testing this POC by trying to insert a header into the response (which will prove that I can edit the response), but I'm having issues with SSL proxying (non-SSL proxying works fine).
Note that I'm not concerned about any certificate errors or the like -- this is purely for internal testing.
I've got the server set up and see the X-MSCProxy Header on a non-SSL page:
jshannon-macbookpro:pagespeed_proxy jshannon$ curl -vv --proxy pagespeed_proxy:3ja82ad9@localhost:8080 -D - -o /dev/null http://www.slate.com * TCP_NODELAY set * Connected to localhost (::1) port 8080 (#0) * Proxy auth using Basic with user 'pagespeed_proxy' > GET http://www.slate.com/ HTTP/1.1 > Host: www.slate.com ... > < HTTP/1.1 200 OK HTTP/1.1 200 OK < Date: Mon, 30 Oct 2017 18:10:40 GMT Date: Mon, 30 Oct 2017 18:10:40 GMT < Server: Apache/2.2.29 (Amazon) Server: Apache/2.2.29 (Amazon) ... < Content-Length: 187051 Content-Length: 187051 ... < X-Instart-Request-ID: 8286987369135064135:FWP01-NPPRY22:1509387040:0 X-Instart-Request-ID: 8286987369135064135:FWP01-NPPRY22:1509387040:0 < Via: 1.1 172.17.0.2:8080 Via: 1.1 172.17.0.2:8080 < X-MSCProxy: SansPS X-MSCProxy: SansPS But when I make the same request to Slate's SSL page I don't see my proxy:
jshannon-macbookpro:pagespeed_proxy jshannon$ curl -vv --proxy pagespeed_proxy:3ja82ad9@localhost:8080 -D - -o /dev/null https://www.slate.com * Connected to localhost (::1) port 8080 (#0) * Establish HTTP proxy tunnel to www.slate.com:443 * Proxy auth using Basic with user 'pagespeed_proxy' > CONNECT www.slate.com:443 HTTP/1.1 > Host: www.slate.com:443 < HTTP/1.0 200 Connection Established HTTP/1.0 200 Connection Established < Proxy-agent: Apache/2.4.25 (Debian) Proxy-agent: Apache/2.4.25 (Debian) < * Proxy replied OK to CONNECT request * TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 * Server certificate: ssl004.insnw.net * Server certificate: GlobalSign CloudSSL CA - SHA256 - G3 * Server certificate: GlobalSign Root CA > GET / HTTP/1.1 > Host: www.slate.com > User-Agent: curl/7.54.0 > Accept: */* > < Content-Length: 187044 Content-Length: 187044 < Connection: keep-alive Connection: keep-alive < Server: Apache/2.2.29 (Amazon) Server: Apache/2.2.29 (Amazon) < X-Instart-Request-ID: 762420041708891440:FWP01-NPPRY21:1509387251:0 X-Instart-Request-ID: 762420041708891440:FWP01-NPPRY21:1509387251:0 I've found a lot of posts that say this is possible (and, technically, it should be) with various httpd.conf suggestions, but nothing I've tried has worked. Right now my httpd.conf looks like:
<VirtualHost *:8080> ProxyRequests On ProxyVia On Header set X-MSCProxy SansPS #SSLEngine On # suggestion that this allows termination ProxyPreserveHost On SSLProxyEngine on SSLProxyCheckPeerCN Off SSLProxyCheckPeerExpire Off SSLProxyCheckPeerName Off SSLCertificateFile /etc/apache2/ssl/localhost.crt SSLCertificateKeyFile /etc/apache2/ssl/localhost.key ModPagespeed Off </VirtualHost> FWIW, when I enable SSLEngine on this proxy (as has been suggested) then the request simply doesn't work with this error from Apache:
[Mon Oct 30 18:20:20.705047 2017] [ssl:info] [pid 372:tid 140147985901312] [client 172.17.0.1:34012] AH01996: SSL handshake failed: HTTP spoken on HTTPS port; trying to send HTML error page [Mon Oct 30 18:20:20.705107 2017] [ssl:info] [pid 372:tid 140147985901312] SSL Library Error: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request -- speaking HTTP to HTTPS port!? Which I guess makes sense as the proxy protocol isn't expecting an HTTPS connection directly to the proxy.
1 Answers
Answers 1
I would try to use the output filter feautre fom apache.
https://www.modpagespeed.com/doc/configuration#apache_specific
AddOutputFilterByType MOD_PAGESPEED_OUTPUT_FILTER text/html
0 comments:
Post a Comment