Solved

Reverse proxy and self signed SSL Certificate

Posted on 2012-03-12
7
805 Views
Last Modified: 2012-04-06
I am running an internal web server which has the public DNS https://xyz.com
This is accesible via our reverse proxy server (Apache) http://proxyserver.com

I have the problem when external users go to  https://xyz.com, and try to install the self signed cerificate into the trusted root certificates for Internet explorer they are issued with the certifcate from our reverse proxy http://proxyserver.com

I know this works because on my home pc (outside of work, Vista) I am issued with the certificate from https://xyz.com.  

So here are the steps
User uses IE and enters in https://xyz.com, they get a certifcate error, they then click on view certificates and see that the certifcate is for proxyserver.com ,not xyz.com.
Of course when they try to install the certifcate correctly everytime they go to xyz.com they will get the certificate error.
0
Comment
Question by:IandINSW
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
7 Comments
 
LVL 12

Expert Comment

by:Amick
ID: 37712057
0
 
LVL 5

Expert Comment

by:ACECORP
ID: 37712076
I believe that the only way you can fix the issue is to modify your architecture.

I would advise the following...

If a user tries to access http://xyz.com the public address for http://xyz.com must be an IP address associated with the apache instance for xyz.com on your reverse proxy server (you will have a ton of them).

When the external user hits that reverse proxy apache site, your reverse proxy server apache site will then execute a re-write rule to re-write your request to the proper internal server inside your network.

The external user's web browser will never see or know about this re-write rule because they are interacting with http://xyz.com on your reverse proxy server. Not with http://myinternalwebsite.local thats inside your network.

The SSL Certificate for xyz.com must sit on the reverse proxy server's apache site for xyz.com
0
 
LVL 1

Author Comment

by:IandINSW
ID: 37712125
The strange thing is I am issued the right certificate on some computers and not on others!!! :(
On one machine using Windows server 2008 R2 IE 9.0 I get the certificate for xyz.com.
On another machine WIn 7 Ultimate IE9.08 they are getting the proxyserver.com certificate.
0
NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

 
LVL 5

Expert Comment

by:ACECORP
ID: 37714840
You may need to trace out the traffic at the packet level using a sniffer to get to the bottom of the situation.
0
 
LVL 1

Author Comment

by:IandINSW
ID: 37718223
Packet sniffer just takes it to another level which will not help me as I can not read or understand the results.  I did find on the IE 9.0 this fixed the problem.  Tools --> Options --> Advanced TAB in the SSL options, I made sure only SSL 3.0 was selected, but on IE 8.0 on the XP machine the problem is still occuring! :(
0
 
LVL 1

Accepted Solution

by:
IandINSW earned 0 total points
ID: 37794199
I found out that on some computers it is an IIE setting for SSL certificates.
Tools --> Internet options --> Advanced TAB, Use SSL3.0 only tick selected and untick Use SSl 2.0. Fixed it on some.
0
 
LVL 1

Author Closing Comment

by:IandINSW
ID: 37815461
I resolved it so only good.
0

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Evaluating Enterprise Antivirus solutions 2 80
How long to crack a 8 chars alphanumeric password 18 134
Cisco 3650x ACL 8 51
IT pictures and movies to alert the staff 11 70
Many old projects have bad code, but the budget doesn't exist to rewrite the codebase. You can update this code to be safer by introducing contemporary input validation, sanitation, and safer database queries.
Smart phones, smart watches, Bluetooth-connected devices—the IoT is all around us. In this article, we take a look at the security implications of our highly connected world.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question