Subject: RE: http to https forward

From: David Marshall <[email-masked]>
Date: Wed, 24 Jul 2002 14:58:30 -0700

This can be done with proxypass as long as the urls are relative. If urls
are imbedded in javascript, I have had to write a perl module to 
re-write urls.

David Marshall

-----Original Message-----
From: David Iungerich [mailto:[email-masked]]
Sent: Wednesday, July 24, 2002 12:07 PM
To: [email-masked]
Subject: http to https forward
Importance: High

I need to implement Apache as an https to http forwarder.  I belive I need
to use
ProxyPass or Redirect, but am having difficulty figuring out the correct
configuration.
My scenario is as follows:

I have an appserver that needs to POST http requests to another company's
appserver.  Unfortunately, the particular product we are using has issues
being able to send https, and the other company requires it.  They have
issued us certificates to talk to them.  I need to be able to send http POST
reqests to an Apache webserver, have it encrypt the request with the other
company's cert, and then pass the POST onto that company's server via https.
No browser involved.  Eventually, I will need to do the same thing in
reverse, but initially I just need to be able to send in this direction.
Can you tell me what all specific entries needed in the conf file to
implement
this.  Again, our server http to Apache, then encrypt using cert we were
given, and Apache to other
company's server via https.

Apache Vesion is currently 1.3.23 - will update for security issues once we
can implement this scenario.
Running on Suse Linux 8.0

Thanks,
David

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Geoffrey Talvola <[email-masked]>
Date: Wed, 24 Jul 2002 17:35:56 -0400

Stunnel can transform http requests into https requests.

http://www.stunnel.org/

- Geoff

> Sent: Wednesday, July 24, 2002 4:53 PM
> Subject: RE: http to https forward
> 
> 
> yes, that is correct.  I meant http to https.  So, there is 
> no way to do
> this with existing mods?  I have to use something else?  Java 
> or Python
> program?  Anyone already have anything?
> 
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Michael Pacey
> Sent: Wednesday, July 24, 2002 3:29 PM
> Subject: Re: http to https forward
> 
> 
> Quoting David Iungerich <[email-masked]>:
> 
> > I need to implement Apache as an https to http forwarder.  
> I belive I
> > need
> > to use
> Just to clarify, I think you mean http to https forwarder, as in your
> subject;
> Apache forwards https to http without any problems.
> 
> But for http to https, your problem isn't configuration; 
> Apache+mod_ssl
> doesn't
> have the code for initiation of HTTPS connections. I've looked!
> 
> Everybody told me it wouldn't work, I didn't believe them, I 
> couldn't make
> it
> work, I read the code, it's not there!
> 
> The only product I know of that might be able to do this is 
> IBM EdgeServer,
> and
> possibly Netscape. Have to say I don't like EdgeServer and I have no
> experience
> of Netscape.
> 
> Is there no-one around who'd like to code this? There are 
> quite a few people
> who
> want to use Apache to initiate HTTPS connections. I don't 
> have the time /
> coding
> skills.
> --
> Web: http://sydb.dyndns.org
> ICQ: 152392113 (New to ICQ? http://www.mirabilis.com)
> IRC: #sydb on EFnet (New to IRC? http://www.irchelp.org)

---

From: "arcean" <[email-masked]>
Date: Fri, 26 Jul 2002 03:02:52 -0700

---------- Original Message ----------------------------------
From: "M.E. Post" <[email-masked]>
Reply-To: [email-masked]
Date:  Wed, 24 Jul 2002 23:10:15 +0200

BOOOOO 
HISSSSSS 
MICROSOSOFT
BULLSHIT ....

(you search for it :) don't teas me ;) )

>With the risk of booing and hissing but Microsoft ISA Server could do this
>as well. It's capable of doing SSL Bridging, i.e. a full SSL proxy. It could
>also be configured to have an HTTP session to the proxy and a HTTPS session
>to the target platform.
>
>Have a look at http://www.microsoft.com/isaserver and
>http://www.isaserver.org/pages/articles.asp?art=157
>
>hth
>
>Meint
>
>
>
>----- Original Message -----
>From: "Michael Pacey" <[email-masked]>
>To: <[email-masked]>
>Sent: Wednesday, July 24, 2002 10:29 PM
>> But for http to https, your problem isn't configuration; Apache+mod_ssl
>doesn't
>> Everybody told me it wouldn't work, I didn't believe them, I couldn't make
>it
>> The only product I know of that might be able to do this is IBM
>EdgeServer, and
>> Is there no-one around who'd like to code this? There are quite a few
>people who
>> want to use Apache to initiate HTTPS connections. I don't have the time /
>coding
>> skills.
>> --

__________________________________________________
D O T E A S Y - "Join the web hosting revolution!"
             http://www.doteasy.com
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Clemente, Michael P." <[email-masked]>
Date: Fri, 26 Jul 2002 08:53:16 -0400

Try looking at documentation for mod-rewrite.  It is part of the mod_ssl
distribution.  Right now we have a few servers that take any off-site http
request rewrite the URL to https.  

http://www.modssl.org/docs/2.8/ssl_faq.html#relative-links

http://httpd.apache.org/docs/mod/mod_rewrite.html

Hope this helps.

Michael Clemente
Network Specialist
Network & System Services
Rowan University

-----Original Message-----
From: David Iungerich [mailto:[email-masked]] 
Sent: Wednesday, July 24, 2002 3:07 PM
To: [email-masked]
Subject: http to https forward
Importance: High

I need to implement Apache as an https to http forwarder.  I belive I need
to use ProxyPass or Redirect, but am having difficulty figuring out the
correct configuration. My scenario is as follows:

I have an appserver that needs to POST http requests to another company's
appserver.  Unfortunately, the particular product we are using has issues
being able to send https, and the other company requires it.  They have
issued us certificates to talk to them.  I need to be able to send http POST
reqests to an Apache webserver, have it encrypt the request with the other
company's cert, and then pass the POST onto that company's server via https.
No browser involved.  Eventually, I will need to do the same thing in
reverse, but initially I just need to be able to send in this direction. Can
you tell me what all specific entries needed in the conf file to implement
this.  Again, our server http to Apache, then encrypt using cert we were
given, and Apache to other company's server via https.

Apache Vesion is currently 1.3.23 - will update for security issues once we
can implement this scenario. Running on Suse Linux 8.0

Thanks,
David

---

From: Geoffrey Talvola <[email-masked]>
Date: Fri, 26 Jul 2002 12:48:39 -0400

Setting up the forwarding without a certificate is as easy as running:

stunnel -c -r www.paypal.com:443 -d 127.0.0.1:5555

Then you can connect to http://localhost:5555/ and it will forward your
request to www.paypal.com using SSL.

As far as setting up the certificate stuff, I haven't done it, but
http://www.stunnel.org/ seems to have good instructions.

- Geoff

> Sent: Friday, July 26, 2002 11:21 AM
> Arcean,
> I'm probably going to continue with my Apache 2.0.39 route, 
> but what all
> specifically is involved in the setup of Stunnel to do what I 
> am looking
> for?  If it's quicker, I may take that route.
> 
> Thanks,
> David
> 
> [mailto:[email-masked]]On Behalf Of arcean
> Sent: Friday, July 26, 2002 4:56 AM
> USE Stunnel it's Really simpe
> 
> Ido use it for exactly the same probleme
> 
> and i use reciproc - authentification (client&serveur)
> 
> good perf on *nix
> no so bad on win32 ...
> 
> >issued us certificates to talk to them.  I need to be able 
> to send http
> POST

---

From: [email-masked]
Date: Fri, 26 Jul 2002 17:38:22 +0000

I am away from the office until the Monday 5th August 2002 

I will get back to you as soon as i can on my return.

If it's an urgent Online Learning Support Unit / Web/ MUBSWEB/ MUBS Online matter
that requires urgent attention then  please contact either  Sanjay1 or Jeff1
who should be able to help.

All the best 
Alex