You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "rugman66 ." <jb...@gmail.com> on 2020/04/17 17:02:23 UTC
Reverse proxy and SSL redirect
Hello,
I have Apache 2.4.6 running as reverse proxy for Tomcat 7.0.96, both
running SSL, and a functioning redirect from HTTP to HTTPS for both
Apache and Tomcat. ( Need to use both these releases due to IT
availability and app requirements )
Prior to enabling SSL on both a Json GET command made to the
application worked. Now after enabling SSL and the Apache redirect,
when the json calls are made to the application with the URL starting
with HTTP:// that should be
redirected to HTTPS:// the following errors occurs.
415 Unsupported media type
"message": "Unsupported Media Type in Header"
When the same json GET command is issued to the same URL using
HTTPS:// it works. It looks as if communication is breaking down
between Apache and Tomcat. Below are both Apache and Tomcat confs. I
have not been able
to figure out why this is happening, and thus be able to fix it. I’m
asking if the SME’s in this mail list can look at the below configs
and see if I am missing a required directive, or if I have them in an
incorrect order.
Apache
<VirtualHost *:80>
ServerName http://foo.domain.com
Redirect / https://foo.domain.com/
</VirtualHost>
<VirtualHost _default_:443>
SSLEngine on
SSLProxyProtocol all
SSLCertificateFile "/auto/foo/ssl_certificate/cert.cer"
SSLCertificateChainFile "/auto/some-path/ssl_certificate/chain.cer"
SSLCertificateKeyFile "/auto/some-path/ssl_certificate/some.key"
SSLCipherSuite "ALL:!ADH:!SSLv2:!EXPORT40:!EXP:!LOW"
ServerName "foo.domain.com"
TraceEnable Off
ProxyRequests Off
ProxyPreserveHost Off
SSLProxyEngine on
AddDefaultCharset utf-8
AddType 'application/json; charset=UTF-8' .json
ProxyPass "/owe" "https://foo.domain.com:8443/app"
ProxyPassReverse "/owe" "https://foo.domain.com:8443/app"
</VirtualHost>
Tomcat
<Connector port="8110" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="443"
proxyName="foo.domian.com"
ProxyPort="80"
<Connector
port="8443"
scheme="https"
secure="true"
protocol="org.apache.coyote.http11.Http11AprProtocol"
SSLEnabled="true"
SSLCipherSuite="ALL:!ADH:!SSLv2:!EXPORT40:!EXP:!LOW"
SSLCertificateFile="/auto/foo/ssl_certificate/cert.cer"
SSLCertificateChainFile="/auto/some-path/ssl_certificate/chain.cer"
SSLCertificateKeyFile="/auto/some-path/ssl_certificate/some.key"
maxThreads="150"
clientAuth="false"
SSLProtocol="TLSv1.2 -SSLv2 -SSLv3 -TLSv1 -TLSv1.1"
maxHttpHeaderSize="32768"
URIEncoding="UTF-8"
/>
Appreciate any insight.
Regards
-John
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Fwd: Reverse proxy and SSL redirect
Posted by "rugman66 ." <jb...@gmail.com>.
On Wed, Jul 1, 2020 at 3:26 AM Mark Thomas <ma...@apache.org> wrote:
>
> On 01/07/2020 00:41, rugman66 . wrote:
> > On Wed, Apr 22, 2020 at 9:21 AM Mark Thomas <ma...@apache.org> wrote:
> >>
> >> On 22/04/2020 00:11, rugman66 . wrote:
> >>
> >> <snip/>
> >>
> >>> Tomcat log (I'm trying to get more debug level logging)
> >>> 2020-04-21 13:39:33 INFO app.CompletionRestController
> >>> Unsupported Media Type in Header
> >>>
> >>> Postman
> >>> 415 Unsupported Media Type
> >>>
> >>> GET URL
> >>> http://server.com/app/api/completions.json?username=foo
> >>>
> >>> Both Tomcat and Apache are running SSL because all internal endpoints
> >>> are required to be secure.
> >>
> >> Looks like the app is generating the error. That moves us forwards.
> >>
> >> Try enabling the RequestDumperFilter. That should dump the full set of
> >> request headers received which will hopefully help explain what is
going on.
> >>
> >> Mark
> >
> > Hi Mark,
> >
> > Was on unplanned leave for the past few months, but back.
> >
> > I did try to enable RequestDumperFilter, however the file was created
> > but no log entries created. I did find something interesting. When I
> > test in Postman with
> > HTTP it does redirect to HTTPD but throws the error. However when I
> > change the URL in Postman using HTTPD I get the expected reply and see
> > the
> > proxy is indeed working. It's only throwing the error when the
> > redirect occurs. Seems to me the issue lies there, but I still can't
> > find a resolution. Any
> > suggestions would be appreciated.
>
> You need to find a way to see the full traffic for both client<->httpd
> and httpd<->Tomcat.
>
> Wireshark is one option. You'll need to configure it to decrypt the TLS.
>
> The access logs will also confirm whether requests are passed to Tomcat
> or handled by httpd.
>
> Mark
Unfortunately I cannot use wireshark as this is in one of our data centers,
and information security would flag packet sniffing as malicious. However I
did record the Apache access log entry for one attempt
and Apache error log entries from three separate attempts. Interestingly
enough all three differ in length. Also included the catalina.out log
entry. Below are the log snipents.
Appreciate your time
-John
*Tomcat*
catalina.out:
2020-07-01 13:18:59 INFO app.CompletionRestController Unsupported Media
Type in Header
*Apache*
access log:
10.24.36.111 - - [01/Jul/2020:13:18:59 -0700] "GET
/app/api/completions.json?username=me HTTP/1.1" 415 46 "-" "Mozilla/5.0
(Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0"
error log:
[Wed Jul 01 10:42:24.994833 2020] [ssl:info] [pid 4874] [client
10.24.36.111:54100] AH01964: Connection to child 2 established (server
englearn-app3.foo.com:443)
[Wed Jul 01 10:42:25.011695 2020] [proxy:debug] [pid 72913]
proxy_util.c(1843): AH00925: initializing worker proxy:reverse shared
[Wed Jul 01 10:42:25.011740 2020] [proxy:debug] [pid 72913]
proxy_util.c(1885): AH00927: initializing worker proxy:reverse local
[Wed Jul 01 10:42:25.011903 2020] [proxy:debug] [pid 72913]
proxy_util.c(1936): AH00931: initialized single connection worker in child
72913 for (*)
[Wed Jul 01 10:42:25.011912 2020] [proxy:debug] [pid 72913]
proxy_util.c(1843): AH00925: initializing worker
https://englearn-app3.foo.com:8443/app shared
[Wed Jul 01 10:42:25.011917 2020] [proxy:debug] [pid 72913]
proxy_util.c(1885): AH00927: initializing worker
https://englearn-app3.foo.com:8443/app local
[Wed Jul 01 10:42:25.011934 2020] [proxy:debug] [pid 72913]
proxy_util.c(1936): AH00931: initialized single connection worker in child
72913 for (englearn-app3.foo.com)
[Wed Jul 01 10:42:25.041766 2020] [proxy:trace2] [pid 4874]
proxy_util.c(1985): [client 10.24.36.111:54100] https: found worker
https://englearn-app3.foo.com:8443/app for
https://englearn-app3.foo.com:8443/app/api/completions.json?username=me,
referer: http://englearn-app3.foo.com/app/api/completions.json?username=me
[Wed Jul 01 10:42:25.041787 2020] [proxy:debug] [pid 4874]
mod_proxy.c(1123): [client 10.24.36.111:54100] AH01143: Running scheme
https handler (attempt 0), referer:
http://englearn-app3.foo.com/app/api/completions.json?username=me
[Wed Jul 01 10:42:25.041804 2020] [proxy:debug] [pid 4874]
proxy_util.c(2203): AH00942: HTTPS: has acquired connection for (
englearn-app3.foo.com)
[Wed Jul 01 10:42:25.041826 2020] [proxy:debug] [pid 4874]
proxy_util.c(2256): [client 10.24.36.111:54100] AH00944: connecting
https://englearn-app3.foo.com:8443/app/api/completions.json?username=me to
englearn-app3.foo.com:8443, referer:
http://englearn-app3.foo.com/app/api/completions.json?username=me
[Wed Jul 01 10:42:25.042535 2020] [proxy:debug] [pid 4874]
proxy_util.c(2426): [client 10.24.36.111:54100] AH00947: connected
/app/api/completions.json?username=me to englearn-app3.foo.com:8443,
referer: http://englearn-app3.foo.com/app/api/completions.json?username=me
[Wed Jul 01 10:42:25.042561 2020] [proxy:trace2] [pid 4874]
proxy_util.c(2768): HTTPS: fam 2 socket created to connect to
englearn-app3.foo.com
[Wed Jul 01 10:42:25.042680 2020] [proxy:debug] [pid 4874]
proxy_util.c(2802): AH02824: HTTPS: connection established with
171.71.174.236:8443 (englearn-app3.foo.com)
[Wed Jul 01 10:42:25.042706 2020] [proxy:debug] [pid 4874]
proxy_util.c(2942): AH00962: HTTPS: connection complete to
171.71.174.236:8443 (englearn-app3.foo.com)
[Wed Jul 01 10:42:25.042714 2020] [ssl:info] [pid 4874] [remote
171.71.174.236:8443] AH01964: Connection to child 0 established (server
englearn-app3.foo.com:443)
[Wed Jul 01 10:42:25.052202 2020] [proxy:debug] [pid 4874]
proxy_util.c(2218): AH00943: https: has released connection for (
englearn-app3.foo.com)
[Wed Jul 01 10:42:26.006881 2020] [proxy:debug] [pid 72915]
proxy_util.c(1843): AH00925: initializing worker proxy:reverse shared
[Wed Jul 01 10:42:26.006924 2020] [proxy:debug] [pid 72915]
proxy_util.c(1885): AH00927: initializing worker proxy:reverse local
[Wed Jul 01 10:42:26.006965 2020] [proxy:debug] [pid 72915]
proxy_util.c(1936): AH00931: initialized single connection worker in child
72915 for (*)
[Wed Jul 01 10:42:26.006977 2020] [proxy:debug] [pid 72915]
proxy_util.c(1843): AH00925: initializing worker
https://englearn-app3.foo.com:8443/app shared
[Wed Jul 01 10:42:26.006983 2020] [proxy:debug] [pid 72915]
proxy_util.c(1885): AH00927: initializing worker
https://englearn-app3.foo.com:8443/app local
[Wed Jul 01 10:42:26.007000 2020] [proxy:debug] [pid 72915]
proxy_util.c(1936): AH00931: initialized single connection worker in child
72915 for (englearn-app3.foo.com)
[Wed Jul 01 10:42:30.053800 2020] [ssl:info] [pid 4874] (70007)The timeout
specified has expired: [client 10.24.36.111:54100] AH01991: SSL input
filter read failed.
[Wed Jul 01 13:14:38.484133 2020] [ssl:info] [pid 92711] [client
10.24.36.111:63197] AH01964: Connection to child 2 established (server
englearn-app3.foo.com:443)
[Wed Jul 01 13:14:38.508915 2020] [proxy:trace2] [pid 92711]
proxy_util.c(1985): [client 10.24.36.111:63197] https: found worker
https://englearn-app3.foo.com:8443/app for
https://englearn-app3.foo.com:8443/app/api/completions.json?username=me
[Wed Jul 01 13:14:38.508959 2020] [proxy:debug] [pid 92711]
mod_proxy.c(1123): [client 10.24.36.111:63197] AH01143: Running scheme
https handler (attempt 0)
[Wed Jul 01 13:14:38.508976 2020] [proxy:debug] [pid 92711]
proxy_util.c(2203): AH00942: HTTPS: has acquired connection for (
englearn-app3.foo.com)
[Wed Jul 01 13:14:38.508991 2020] [proxy:debug] [pid 92711]
proxy_util.c(2256): [client 10.24.36.111:63197] AH00944: connecting
https://englearn-app3.foo.com:8443/app/api/completions.json?username=me to
englearn-app3.foo.com:8443
[Wed Jul 01 13:14:38.509095 2020] [proxy:debug] [pid 92711]
proxy_util.c(2426): [client 10.24.36.111:63197] AH00947: connected
/app/api/completions.json?username=me to englearn-app3.foo.com:8443
[Wed Jul 01 13:14:38.509179 2020] [proxy:trace2] [pid 92711]
proxy_util.c(2768): HTTPS: fam 2 socket created to connect to
englearn-app3.foo.com
[Wed Jul 01 13:14:38.509233 2020] [proxy:debug] [pid 92711]
proxy_util.c(2802): AH02824: HTTPS: connection established with
171.71.174.236:8443 (englearn-app3.foo.com)
[Wed Jul 01 13:14:38.509255 2020] [proxy:debug] [pid 92711]
proxy_util.c(2942): AH00962: HTTPS: connection complete to
171.71.174.236:8443 (englearn-app3.foo.com)
[Wed Jul 01 13:14:38.509264 2020] [ssl:info] [pid 92711] [remote
171.71.174.236:8443] AH01964: Connection to child 0 established (server
englearn-app3.foo.com:443)
[Wed Jul 01 13:14:38.517001 2020] [proxy:debug] [pid 92711]
proxy_util.c(2218): AH00943: https: has released connection for (
englearn-app3.foo.com)
[Wed Jul 01 13:14:39.256467 2020] [proxy:debug] [pid 92718]
proxy_util.c(1843): AH00925: initializing worker proxy:reverse shared
[Wed Jul 01 13:14:39.256526 2020] [proxy:debug] [pid 92718]
proxy_util.c(1885): AH00927: initializing worker proxy:reverse local
[Wed Jul 01 13:14:39.256572 2020] [proxy:debug] [pid 92718]
proxy_util.c(1936): AH00931: initialized single connection worker in child
92718 for (*)
[Wed Jul 01 13:14:39.256586 2020] [proxy:debug] [pid 92718]
proxy_util.c(1843): AH00925: initializing worker
https://englearn-app3.foo.com:8443/app shared
[Wed Jul 01 13:14:39.256604 2020] [proxy:debug] [pid 92718]
proxy_util.c(1885): AH00927: initializing worker
https://englearn-app3.foo.com:8443/app local
[Wed Jul 01 13:14:39.256628 2020] [proxy:debug] [pid 92718]
proxy_util.c(1936): AH00931: initialized single connection worker in child
92718 for (englearn-app3.foo.com)
[Wed Jul 01 13:14:43.518364 2020] [ssl:info] [pid 92711] (70007)The timeout
specified has expired: [client 10.24.36.111:63197] AH01991: SSL input
filter read failed.
[Wed Jul 01 13:18:59.532770 2020] [ssl:info] [pid 92709] [client
10.24.36.111:63288] AH01964: Connection to child 0 established (server
englearn-app3.foo.com:443)
[Wed Jul 01 13:18:59.548285 2020] [proxy:trace2] [pid 92709]
proxy_util.c(1985): [client 10.24.36.111:63288] https: found worker
https://englearn-app3.foo.com:8443/app for
https://englearn-app3.foo.com:8443/app/api/completions.json?username=me
[Wed Jul 01 13:18:59.548318 2020] [proxy:debug] [pid 92709]
mod_proxy.c(1123): [client 10.24.36.111:63288] AH01143: Running scheme
https handler (attempt 0)
[Wed Jul 01 13:18:59.548339 2020] [proxy:debug] [pid 92709]
proxy_util.c(2203): AH00942: HTTPS: has acquired connection for (
englearn-app3.foo.com)
[Wed Jul 01 13:18:59.548359 2020] [proxy:debug] [pid 92709]
proxy_util.c(2256): [client 10.24.36.111:63288] AH00944: connecting
https://englearn-app3.foo.com:8443/app/api/completions.json?username=me to
englearn-app3.foo.com:8443
[Wed Jul 01 13:18:59.548412 2020] [proxy:debug] [pid 92709]
proxy_util.c(2426): [client 10.24.36.111:63288] AH00947: connected
/owe/api/completions.json?username=me to englearn-app3.foo.com:8443
[Wed Jul 01 13:18:59.548484 2020] [proxy:trace2] [pid 92709]
proxy_util.c(2768): HTTPS: fam 2 socket created to connect to
englearn-app3.foo.com
[Wed Jul 01 13:18:59.548609 2020] [proxy:debug] [pid 92709]
proxy_util.c(2802): AH02824: HTTPS: connection established with
171.71.174.236:8443 (englearn-app3.foo.com)
[Wed Jul 01 13:18:59.548622 2020] [proxy:debug] [pid 92709]
proxy_util.c(2942): AH00962: HTTPS: connection complete to
171.71.174.236:8443 (englearn-app3.foo.com)
[Wed Jul 01 13:18:59.548627 2020] [ssl:info] [pid 92709] [remote
171.71.174.236:8443] AH01964: Connection to child 0 established (server
englearn-app3.foo.com:443)
[Wed Jul 01 13:18:59.556770 2020] [proxy:debug] [pid 92709]
proxy_util.c(2218): AH00943: https: has released connection for (
englearn-app3.foo.com)
[Wed Jul 01 13:19:04.558528 2020] [ssl:info] [pid 92709] (70007)The timeout
specified has expired: [client 10.24.36.111:63288] AH01991: SSL input
filter read failed.
Re: Fwd: Reverse proxy and SSL redirect
Posted by Mark Thomas <ma...@apache.org>.
On 01/07/2020 00:41, rugman66 . wrote:
> On Wed, Apr 22, 2020 at 9:21 AM Mark Thomas <ma...@apache.org> wrote:
>>
>> On 22/04/2020 00:11, rugman66 . wrote:
>>
>> <snip/>
>>
>>> Tomcat log (I'm trying to get more debug level logging)
>>> 2020-04-21 13:39:33 INFO app.CompletionRestController
>>> Unsupported Media Type in Header
>>>
>>> Postman
>>> 415 Unsupported Media Type
>>>
>>> GET URL
>>> http://server.com/app/api/completions.json?username=foo
>>>
>>> Both Tomcat and Apache are running SSL because all internal endpoints
>>> are required to be secure.
>>
>> Looks like the app is generating the error. That moves us forwards.
>>
>> Try enabling the RequestDumperFilter. That should dump the full set of
>> request headers received which will hopefully help explain what is going on.
>>
>> Mark
>
> Hi Mark,
>
> Was on unplanned leave for the past few months, but back.
>
> I did try to enable RequestDumperFilter, however the file was created
> but no log entries created. I did find something interesting. When I
> test in Postman with
> HTTP it does redirect to HTTPD but throws the error. However when I
> change the URL in Postman using HTTPD I get the expected reply and see
> the
> proxy is indeed working. It's only throwing the error when the
> redirect occurs. Seems to me the issue lies there, but I still can't
> find a resolution. Any
> suggestions would be appreciated.
You need to find a way to see the full traffic for both client<->httpd
and httpd<->Tomcat.
Wireshark is one option. You'll need to configure it to decrypt the TLS.
The access logs will also confirm whether requests are passed to Tomcat
or handled by httpd.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Fwd: Reverse proxy and SSL redirect
Posted by "rugman66 ." <jb...@gmail.com>.
On Wed, Apr 22, 2020 at 9:21 AM Mark Thomas <ma...@apache.org> wrote:
>
> On 22/04/2020 00:11, rugman66 . wrote:
>
> <snip/>
>
> > Tomcat log (I'm trying to get more debug level logging)
> > 2020-04-21 13:39:33 INFO app.CompletionRestController
> > Unsupported Media Type in Header
> >
> > Postman
> > 415 Unsupported Media Type
> >
> > GET URL
> > http://server.com/app/api/completions.json?username=foo
> >
> > Both Tomcat and Apache are running SSL because all internal endpoints
> > are required to be secure.
>
> Looks like the app is generating the error. That moves us forwards.
>
> Try enabling the RequestDumperFilter. That should dump the full set of
> request headers received which will hopefully help explain what is going on.
>
> Mark
Hi Mark,
Was on unplanned leave for the past few months, but back.
I did try to enable RequestDumperFilter, however the file was created
but no log entries created. I did find something interesting. When I
test in Postman with
HTTP it does redirect to HTTPD but throws the error. However when I
change the URL in Postman using HTTPD I get the expected reply and see
the
proxy is indeed working. It's only throwing the error when the
redirect occurs. Seems to me the issue lies there, but I still can't
find a resolution. Any
suggestions would be appreciated.
Regards
-John
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Fwd: Reverse proxy and SSL redirect
Posted by Mark Thomas <ma...@apache.org>.
On 22/04/2020 00:11, rugman66 . wrote:
<snip/>
> Tomcat log (I'm trying to get more debug level logging)
> 2020-04-21 13:39:33 INFO app.CompletionRestController
> Unsupported Media Type in Header
>
> Postman
> 415 Unsupported Media Type
>
> GET URL
> http://server.com/app/api/completions.json?username=foo
>
> Both Tomcat and Apache are running SSL because all internal endpoints
> are required to be secure.
Looks like the app is generating the error. That moves us forwards.
Try enabling the RequestDumperFilter. That should dump the full set of
request headers received which will hopefully help explain what is going on.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Fwd: Reverse proxy and SSL redirect
Posted by "rugman66 ." <jb...@gmail.com>.
On Sat, Apr 18, 2020 at 1:46 AM Mark Thomas <ma...@apache.org> wrote:
>
> On 17/04/2020 18:15, rugman66 . wrote:
> > Made correction to ProxyPass and ProxyPassReverse.
>
> Good. Changing the context path in the reverse proxy opens up the
> possibility for all sorts of breakage and is generally best avoided if
> at all possible.
>
> <snip/>
>
> > I have Apache 2.4.6 running as reverse proxy for Tomcat 7.0.96, both
> > running SSL, and a functioning redirect from HTTP to HTTPS for both
> > Apache and Tomcat. ( Need to use both these releases due to IT
> > availability and app requirements )
> > Prior to enabling SSL on both a Json GET command made to the
> > application worked. Now after enabling SSL and the Apache redirect,
> > when the json calls are made to the application with the URL starting
> > with HTTP:// that should be
> > redirected to HTTPS:// the following errors occurs.
> >
> > 415 Unsupported media type
> > "message": "Unsupported Media Type in Header"
>
> Can you tell where that error message is coming from? httpd? Tomcat? The
> application?
>
> > When the same json GET command is issued to the same URL using
> > HTTPS:// it works. It looks as if communication is breaking down
> > between Apache and Tomcat.
>
> What URL is used with that GET?
>
> What appears in the access logs (httpd and Tomcat) for each of those?
>
> Can you also log the HTTP headers sent and received by the client for
> each request?
>
> > Apache
>
> I'm no httpd expert...
>
> > <VirtualHost *:80>
> > ServerName http://foo.domain.com
> > Redirect / https://foo.domain.com/
> > </VirtualHost>
>
> But the above looks to be consistent with:
> https://cwiki.apache.org/confluence/display/HTTPD/RedirectSSL
>
> > <VirtualHost _default_:443>
> > SSLEngine on
> > SSLProxyProtocol all
> > SSLCertificateFile "/auto/foo/ssl_certificate/cert.cer"
> > SSLCertificateChainFile "/auto/some-path/ssl_certificate/chain.cer"
> > SSLCertificateKeyFile "/auto/some-path/ssl_certificate/some.key"
> > SSLCipherSuite "ALL:!ADH:!SSLv2:!EXPORT40:!EXP:!LOW"
> > ServerName "foo.domain.com"
> > TraceEnable Off
> > ProxyRequests Off
> > ProxyPreserveHost Off
> > SSLProxyEngine on
> > AddDefaultCharset utf-8
> > AddType 'application/json; charset=UTF-8' .json
> > ProxyPass "/app" "https://foo.domain.com:8443/app"
> > ProxyPassReverse "/app" "https://foo.domain.com:8443/app"
> > </VirtualHost>
>
> Hmm. I'm wondering about that AddType but it looks OK.
>
> > Tomcat
> >
> > <Connector port="8110" protocol="HTTP/1.1"
> > connectionTimeout="20000"
> > redirectPort="443"
> > proxyName="foo.domian.com"
> > ProxyPort="80"
>
> Will this become unnecessary once the HTTPS redirect is working? The
> redirect will always happen in httpd.
>
> > <Connector
> > port="8443"
> > scheme="https"
> > secure="true"
> > protocol="org.apache.coyote.http11.Http11AprProtocol"
> > SSLEnabled="true"
> > SSLCipherSuite="ALL:!ADH:!SSLv2:!EXPORT40:!EXP:!LOW"
> > SSLCertificateFile="/auto/foo/ssl_certificate/cert.cer"
> > SSLCertificateChainFile="/auto/some-path/ssl_certificate/chain.cer"
> > SSLCertificateKeyFile="/auto/some-path/ssl_certificate/some.key"
> > maxThreads="150"
> > clientAuth="false"
> > SSLProtocol="TLSv1.2 -SSLv2 -SSLv3 -TLSv1 -TLSv1.1"
> > maxHttpHeaderSize="32768"
> > URIEncoding="UTF-8"
> > />
>
> Again, looks to be OK.
>
> > Appreciate any insight.
>
> I'd want to look at exactly what was in each request/response at each
> stage of this.
>
> Mark
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
Hi Mark,
Answers inline below.
Can you tell where that error message is coming from? httpd? Tomcat?
The application?
HTTPD log
[Tue Apr 21 13:39:33.741636 2020] [ssl:info] [pid 38749]
[client 10.24.61.248:52733] AH01964: Connection to child 0 established
(server foo:443)
[Tue Apr 21 13:39:33.781069 2020] [proxy:trace2] [pid 38749]
proxy_util.c(1985): [client 10.24.61.248:52733] https: found worker
https://foo:8443/foo for
https://foo:8443/foo/api/completions.json?username=foo, referer:
http://foo/app/api/completions.json?username=foo
[Tue Apr 21 13:39:33.781119 2020] [proxy:debug] [pid 38749]
mod_proxy.c(1123): [client 10.24.61.248:52733] AH01143: Running scheme
https handler (attempt 0), referer:
http://foo/app/api/completions.json?username=foo
[Tue Apr 21 13:39:33.781150 2020] [proxy:debug] [pid 38749]
proxy_util.c(2203): AH00942: HTTPS: has acquired connection for
(foo.com)
[Tue Apr 21 13:39:33.781476 2020] [proxy:debug] [pid 38749]
proxy_util.c(2256): [client 10.24.61.248:52733] AH00944: connecting
https://foo:8443/app/api/completions.json?username=foo to foo:8443,
referer: http://foo/app/api/completions.json?username=foo
[Tue Apr 21 13:39:33.781553 2020] [proxy:debug] [pid 38749]
proxy_util.c(2426): [client 10.24.61.248:52733] AH00947: connected
/app/api/completions.json?username=foo to foo:8443, referer:
http://foo/app/api/completions.json?username=foo
[Tue Apr 21 13:39:33.781706 2020] [proxy:trace2] [pid 38749]
proxy_util.c(2768): HTTPS: fam 2 socket created to connect to foo.com
[Tue Apr 21 13:39:33.781938 2020] [proxy:debug] [pid 38749]
proxy_util.c(2802): AH02824: HTTPS: connection established with
171.71.174.236:8443 (foo.com)
[Tue Apr 21 13:39:33.781971 2020] [proxy:debug] [pid 38749]
proxy_util.c(2942): AH00962: HTTPS: connection complete to
171.71.174.236:8443 (foo.com)
[Tue Apr 21 13:39:33.781982 2020] [ssl:info] [pid 38749] [remote
171.71.174.236:8443] AH01964: Connection to child 0 established
(server foo:443)
[Tue Apr 21 13:39:33.796042 2020] [proxy:debug] [pid 38749]
proxy_util.c(2218): AH00943: https: has released connection for
(foo.com)
[Tue Apr 21 13:39:38.798293 2020] [ssl:info] [pid 38749] (70007)The
timeout specified has expired: [client 10.24.61.248:52733] AH01991:
SSL input filter read failed.
Tomcat log (I'm trying to get more debug level logging)
2020-04-21 13:39:33 INFO app.CompletionRestController
Unsupported Media Type in Header
Postman
415 Unsupported Media Type
GET URL
http://server.com/app/api/completions.json?username=foo
Both Tomcat and Apache are running SSL because all internal endpoints
are required to be secure.
Thanks
-John
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Fwd: Reverse proxy and SSL redirect
Posted by Mark Thomas <ma...@apache.org>.
On 17/04/2020 18:15, rugman66 . wrote:
> Made correction to ProxyPass and ProxyPassReverse.
Good. Changing the context path in the reverse proxy opens up the
possibility for all sorts of breakage and is generally best avoided if
at all possible.
<snip/>
> I have Apache 2.4.6 running as reverse proxy for Tomcat 7.0.96, both
> running SSL, and a functioning redirect from HTTP to HTTPS for both
> Apache and Tomcat. ( Need to use both these releases due to IT
> availability and app requirements )
> Prior to enabling SSL on both a Json GET command made to the
> application worked. Now after enabling SSL and the Apache redirect,
> when the json calls are made to the application with the URL starting
> with HTTP:// that should be
> redirected to HTTPS:// the following errors occurs.
>
> 415 Unsupported media type
> "message": "Unsupported Media Type in Header"
Can you tell where that error message is coming from? httpd? Tomcat? The
application?
> When the same json GET command is issued to the same URL using
> HTTPS:// it works. It looks as if communication is breaking down
> between Apache and Tomcat.
What URL is used with that GET?
What appears in the access logs (httpd and Tomcat) for each of those?
Can you also log the HTTP headers sent and received by the client for
each request?
> Apache
I'm no httpd expert...
> <VirtualHost *:80>
> ServerName http://foo.domain.com
> Redirect / https://foo.domain.com/
> </VirtualHost>
But the above looks to be consistent with:
https://cwiki.apache.org/confluence/display/HTTPD/RedirectSSL
> <VirtualHost _default_:443>
> SSLEngine on
> SSLProxyProtocol all
> SSLCertificateFile "/auto/foo/ssl_certificate/cert.cer"
> SSLCertificateChainFile "/auto/some-path/ssl_certificate/chain.cer"
> SSLCertificateKeyFile "/auto/some-path/ssl_certificate/some.key"
> SSLCipherSuite "ALL:!ADH:!SSLv2:!EXPORT40:!EXP:!LOW"
> ServerName "foo.domain.com"
> TraceEnable Off
> ProxyRequests Off
> ProxyPreserveHost Off
> SSLProxyEngine on
> AddDefaultCharset utf-8
> AddType 'application/json; charset=UTF-8' .json
> ProxyPass "/app" "https://foo.domain.com:8443/app"
> ProxyPassReverse "/app" "https://foo.domain.com:8443/app"
> </VirtualHost>
Hmm. I'm wondering about that AddType but it looks OK.
> Tomcat
>
> <Connector port="8110" protocol="HTTP/1.1"
> connectionTimeout="20000"
> redirectPort="443"
> proxyName="foo.domian.com"
> ProxyPort="80"
Will this become unnecessary once the HTTPS redirect is working? The
redirect will always happen in httpd.
> <Connector
> port="8443"
> scheme="https"
> secure="true"
> protocol="org.apache.coyote.http11.Http11AprProtocol"
> SSLEnabled="true"
> SSLCipherSuite="ALL:!ADH:!SSLv2:!EXPORT40:!EXP:!LOW"
> SSLCertificateFile="/auto/foo/ssl_certificate/cert.cer"
> SSLCertificateChainFile="/auto/some-path/ssl_certificate/chain.cer"
> SSLCertificateKeyFile="/auto/some-path/ssl_certificate/some.key"
> maxThreads="150"
> clientAuth="false"
> SSLProtocol="TLSv1.2 -SSLv2 -SSLv3 -TLSv1 -TLSv1.1"
> maxHttpHeaderSize="32768"
> URIEncoding="UTF-8"
> />
Again, looks to be OK.
> Appreciate any insight.
I'd want to look at exactly what was in each request/response at each
stage of this.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Fwd: Reverse proxy and SSL redirect
Posted by "rugman66 ." <jb...@gmail.com>.
Made correction to ProxyPass and ProxyPassReverse.
-John
---------- Forwarded message ---------
From: rugman66 . <jb...@gmail.com>
Date: Fri, Apr 17, 2020 at 10:02 AM
Subject: Reverse proxy and SSL redirect
To: Tomcat Users List <us...@tomcat.apache.org>
Hello,
I have Apache 2.4.6 running as reverse proxy for Tomcat 7.0.96, both
running SSL, and a functioning redirect from HTTP to HTTPS for both
Apache and Tomcat. ( Need to use both these releases due to IT
availability and app requirements )
Prior to enabling SSL on both a Json GET command made to the
application worked. Now after enabling SSL and the Apache redirect,
when the json calls are made to the application with the URL starting
with HTTP:// that should be
redirected to HTTPS:// the following errors occurs.
415 Unsupported media type
"message": "Unsupported Media Type in Header"
When the same json GET command is issued to the same URL using
HTTPS:// it works. It looks as if communication is breaking down
between Apache and Tomcat. Below are both Apache and Tomcat confs. I
have not been able
to figure out why this is happening, and thus be able to fix it. I’m
asking if the SME’s in this mail list can look at the below configs
and see if I am missing a required directive, or if I have them in an
incorrect order.
Apache
<VirtualHost *:80>
ServerName http://foo.domain.com
Redirect / https://foo.domain.com/
</VirtualHost>
<VirtualHost _default_:443>
SSLEngine on
SSLProxyProtocol all
SSLCertificateFile "/auto/foo/ssl_certificate/cert.cer"
SSLCertificateChainFile "/auto/some-path/ssl_certificate/chain.cer"
SSLCertificateKeyFile "/auto/some-path/ssl_certificate/some.key"
SSLCipherSuite "ALL:!ADH:!SSLv2:!EXPORT40:!EXP:!LOW"
ServerName "foo.domain.com"
TraceEnable Off
ProxyRequests Off
ProxyPreserveHost Off
SSLProxyEngine on
AddDefaultCharset utf-8
AddType 'application/json; charset=UTF-8' .json
ProxyPass "/app" "https://foo.domain.com:8443/app"
ProxyPassReverse "/app" "https://foo.domain.com:8443/app"
</VirtualHost>
Tomcat
<Connector port="8110" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="443"
proxyName="foo.domian.com"
ProxyPort="80"
<Connector
port="8443"
scheme="https"
secure="true"
protocol="org.apache.coyote.http11.Http11AprProtocol"
SSLEnabled="true"
SSLCipherSuite="ALL:!ADH:!SSLv2:!EXPORT40:!EXP:!LOW"
SSLCertificateFile="/auto/foo/ssl_certificate/cert.cer"
SSLCertificateChainFile="/auto/some-path/ssl_certificate/chain.cer"
SSLCertificateKeyFile="/auto/some-path/ssl_certificate/some.key"
maxThreads="150"
clientAuth="false"
SSLProtocol="TLSv1.2 -SSLv2 -SSLv3 -TLSv1 -TLSv1.1"
maxHttpHeaderSize="32768"
URIEncoding="UTF-8"
/>
Appreciate any insight.
Regards
-John
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Reverse proxy and SSL redirect
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
John,
On 4/17/20 13:02, rugman66 . wrote:
> I have Apache 2.4.6 running as reverse proxy
Stop right now and patch that thing.
> for Tomcat 7.0.96
Not quite as old, but depending upon your environment, there may be
some critical changes in later versions. (Looks like you are using
mod_proxy_http and should therefore be okay for the worst of these
issues).
> both running SSL, and a functioning redirect from HTTP to HTTPS
> for both Apache and Tomcat.
> ( Need to use both these releases due to IT availability and app
> requirements )
You (or someone else) is making a dangerous security decision by
staying on these versions. If you can't get someone to change their
mind, you may want to remove yourself from the situation or end up
being blamed for your upcoming intrusion.
- -chris
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl6dyYIACgkQHPApP6U8
pFjvUw/9EW+34NLWMDALVUoh5hWdvDChoozLAO34a27TAqtqZWqG+QQUKRJId64y
pHrFWrH2P+3E9VqkMdKrXVmQLFX7NJJfCzN1eB1PcQuWs/JOCoFCGKgM6V/MTgpq
QucO/kQ5r1YJge1Us9KmF+FHLdHCFfzB20vUcL6BoteVTnd/j5BQ3mHGOuy3Lnja
SJC4WX9AJF6vFixLL0AMRif+0njQY3NarXvOFppGBNA0cfWdqYv5SZxe9p1K80sB
y0z71v2S1+Cex+4Rmpk86Eq6kWdG1UTpRbmasr6IKlQ11pgsykUwPbbREUxu5rQQ
/HUCx5nugYRbnOTMklLdU1DCqA+kypS749bEm28YtPVUCz5GUUJSJp+rG92tTWl5
RxUprl0it+4dVV/jjIigMjkosp2sBm8lkuFNcsSGiH1zTof2fIRnxVtYOtrzhs63
5iDxjRKrLdG7F1UZDrGal7adGJ3677RT+ZYE2ZzBr08tx3FAlKQ6jk816wE7egn4
cH4XEwk6YAJuxMXtNLRooz4eEJgo3BrxJT4TJNvdlaIijFt9XeIwHDhlvzdHOmhe
GTTbtzH0AASoBSMh97TzZ9ktpnQ+tEQvq9bhGpjoJfCSs1wEw2a/x3uA/Qjc7kcb
CJlTeiqtoytfNF+IhJvJANg6hiYKmo5L7cwUWtyyXdS4MK6ZdnM=
=8RC0
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org