Skip to main content

Configure SSL on Apache

Terminate SSL at an Apache reverse proxy in front of Tomcat, and redirect all HTTP traffic to HTTPS. The filenames below are examples — use your own key and intermediate files.

Prerequisites​

  • A private key from your CA for your domain (for example *.igrafxdemo.com).
  • The intermediate certificate (for example igrafxdemo_intermediate.crt).

Steps​

  1. Convert the .pfx file with OpenSSL:

    openssl pkcs12 -in igrafxdemo_wildcard.pfx -clcerts -nokeys -out igrafxdemo.com.cer
    openssl pkcs12 -in igrafxdemo_wildcard.pfx -nocerts -nodes -out igrafxdemo.com.key

  2. Move the files to the Apache machine:

    sudo mkdir /etc/apache2/ssl
    sudo mv ~/igrafxdemo.com.cer /etc/apache2/ssl/
    sudo mv ~/igrafxdemo.com.key /etc/apache2/ssl/
    sudo mv ~/igrafxdemo_intermediate.crt /etc/apache2/ssl/

  3. Enable the SSL and rewrite modules (rewrite routes all HTTP traffic to HTTPS):

    sudo a2enmod ssl
    sudo a2enmod rewrite
    sudo service apache2 restart

  4. In /etc/apache2/mods-available/ssl.conf, set the cipher suite and protocol:

    SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"
    SSLProtocol all -SSLv3

  5. In your site's proxy configuration (for example /etc/apache2/sites-available/igxus.igrafxdemo.com.conf), configure the rewrite and SSL virtual hosts:

    <VirtualHost *:81>
        ServerAdmin beta@igrafx.com
        ServerName igxus.igrafxdemo.com
        RewriteEngine On
        RewriteCond %{HTTPS} off
        RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
        ErrorLog ${APACHE_LOG_DIR}/error_proxy_IGXUS.log
        LogLevel warn
        CustomLog ${APACHE_LOG_DIR}/access_proxy.log combined
    </VirtualHost>
    <VirtualHost *:443>
        ServerAdmin beta@igrafx.com
        ServerName igxus.igrafxdemo.com
        ProxyPass /icons !
        ProxyPass /logs !
        SSLEngine on
        SSLProxyVerify none
        SSLProxyCheckPeerCN off
        SSLProxyCheckPeerName off
        SSLProxyCheckPeerExpire off
        SSLProxyEngine On
        SSLCertificateChainFile /etc/apache2/ssl/igrafxdemo_intermediate.crt
        SSLCertificateFile /etc/apache2/ssl/igrafxdemo.com.cer
        SSLCertificateKeyFile /etc/apache2/ssl/igrafxdemo.com.key
        ProxyRequests Off
        ProxyPreserveHost Off
        ProxyPass / http://172.16.250.174:8080/
        ProxyPassReverse / http://172.16.250.174:8080/
        DocumentRoot /var/www
        ErrorLog ${APACHE_LOG_DIR}/error_proxy_IGXUS_SSL.log
        LogLevel warn
        CustomLog ${APACHE_LOG_DIR}/access_proxy_SSL.log combined
    </VirtualHost>

  6. Reload the configuration:

    sudo service apache2 reload