Subject: RE: 1 certificate for several sites using redirection ?

From: [email-masked]
Date: Wed, 12 Jun 2002 11:21:19 +0100

Sounds like you have some absolute links rather than relative links. You can
also use 
proxypass /test https://other-subdomain.ourdomain.com

If the data needs to be secured between the proxy and the destination
server.

- 
John Airey
Internet systems support officer, ITCSD, Royal National Institute of the
Blind,
Bakewell Road, Peterborough PE2 6XU,
Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 [email-masked] 

Is the statement 'There is no such thing as truth'  true?

> -----Original Message-----
> From: Wim Godden [mailto:[email-masked]]
> Sent: 12 June 2002 11:06
> To: [email-masked]
> Subject: Re: 1 certificate for several sites using redirection ?
> 
> 
> proxypass /test http://other-subdomain.ourdomain.com
> doesn't work properly... I get errors about the images being 
> insecure and all links
> point to the wrong position.
> 
> 
> Peter Viertel wrote:
> 
> > You could do that using reverse proxy, ie mod_proxy.
> > Redirects are not going to help.
> >
> > Wim Godden wrote:
> >
> > >Hi,
> > >
> > >I'd like to use a certificate to secure several of our 
> subdomains...
> > >buying hundreds of certificates is simply too expensive.
> > >Is there some way to do this :
> > >
> > >- Install certificate on secure.ourdomain.com
> > >- Let people surf to
> > 
> >https://secure.ourdomain.com/other-subdomain.ourdomain.com/wh
at-ever-page.html
> >
> >Thanks in advance.
> >
> >
> >Greetings,
> >
> >Wim Godden
> >
> >______________________________________________________________________
> >Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> >User Support Mailing List                      [email-masked]
> >Automated List Manager                            [email-masked]
> >
> >
>
> ______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> User Support Mailing List                      [email-masked]
> Automated List Manager                            [email-masked]

--
------
Adverteren.be - 100% Nederlandstalig adverteren op kwalitatief hoogstaande
sites !

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

- 

NOTICE: The information contained in this email and any attachments is 
confidential and may be legally privileged. If you are not the 
intended recipient you are hereby notified that you must not use, 
disclose, distribute, copy, print or rely on this email's content. If 
you are not the intended recipient, please notify the sender 
immediately and then delete the email and any attachments from your 
system.

RNIB has made strenuous efforts to ensure that emails and any 
attachments generated by its staff are free from viruses. However, it 
cannot accept any responsibility for any viruses which are 
transmitted. We therefore recommend you scan all attachments.

Please note that the statements and views expressed in this email 
and any attachments are those of the author and do not necessarily 
represent those of RNIB.

RNIB Registered Charity Number: 226227

Website: http://www.rnib.org.uk 

14th June 2002 is RNIB Look Loud Day - visit http://www.lookloud.org.uk to
find out all about it.

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Peter Viertel" <[email-masked]>
Date: Wed, 12 Jun 2002 12:50:12 +0100

yes, i think thats whats happening - you need to review the website 
content you are pointing at. For this to work you can't have any 
absolute hrefs, and also the backend site may issue redirects, for these 
to work you need a ProxyPassReverse which will rewrite the Location: 
header on any redirects the backend site may send.

 For example:

ProxyPass /test    http://other.subdomain.ourdomain.com/
ProxyPassReverse /test  http://other.subdomain.ourdomain.com/

proxypassreverse unfortunately is not case insensitive, and the backend 
webserver may refer to itself canonically, so the location headers may 
have another hostname. Either fix up the backend webserver to match the 
proxypassreverse, or add extra proxypassreverse lines.

The most common cause of redirects is the / bug handlers of tomcat, and 
IIS which kick in if your url ends with / and that resolves to a 
directory, then the webserver looks up what the directoryindex script is 
(eg. index.html) and sends a redirect. This is something to do with 
early revision browser releases, I have no idea which ones or if it 
matters anymore.

Also note that mod_proxy got a big upgrade at apache release 1.3.23 that 
may help things along too in certain cases.

---

From: Wim Godden <[email-masked]>
Date: Wed, 12 Jun 2002 14:08:55 +0200

So there's no system which allows me to really proxy pages and 'modify' them so
that all future connections go through this 'proxy' as well ?

Greetings,

Wim

--
------
Adverteren.be - 100% Nederlandstalig adverteren op kwalitatief hoogstaande sites
!

---

From: "Peter Viertel" <[email-masked]>
Date: Wed, 12 Jun 2002 13:35:04 +0100

thats basically right.

the proxy spec in http/1.1 etc copes with rewriting headers - but 
nothing I've seen rewrites the actual html content - this would be 
possible of course, but there would have to be a new module for apache 
to do it, and architecturally you'd be creating a potential bottleneck 
as the proxy server would have to parse all of the content passing 
through it.

---

From: "Peter Viertel" <[email-masked]>
Date: Wed, 12 Jun 2002 12:50:12 +0100

For example:

---

From: Wim Godden <[email-masked]>
Date: Wed, 12 Jun 2002 14:08:55 +0200

Greetings,

Wim

---

From: Jason Haar <[email-masked]>
Date: Wed, 19 Jun 2002 10:05:26 +1200

On Wed, Jun 12, 2002 at 01:35:04PM +0100, Peter Viertel wrote:
> ...

There is one way...

It can only work if the "internal" server has a hostname that can be
hijacked by the reverse proxy server.

i.e. if you are wanting to do:

client --- Internet ---> https://www.mycompany.com/

..then you can do:

client --- Internet ---> https://www.mycompany.com/ --- Internal ---
http://www.mycompany.com/

e.g. on the Internet www.mycompany.com is 1.2.3.4, whereas internally
www.mycompany.com is 10.1.2.3

Then you can set up your Apache reverse proxy so that it proxies "/" - i.e.
run www.mycompany.com as a full VirtualHost.

Done it - it works :-)

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]