Apache load balancer with https real servers and client certificates
- by Jack Scheible
Our network requirements state that ALL network traffic must be encrypted.
The network configuration looks like this:
------------
/-- https --> | server 1 |
/ ------------
|------------| |---------------|/ ------------
| Client | --- https --> | Load Balancer | ---- https --> | server 2 |
|------------| |---------------|\ ------------
\ ------------
\-- https --> | server 3 |
------------
And it has to pass client certificates.
I've got a config that can do load balancing with in-the-clear real servers:
<VirtualHost *:8666>
DocumentRoot "/usr/local/apache/ssl_html"
ServerName vmbigip1
ServerAdmin jscheible@goeis.com
DirectoryIndex index.html
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
SSLEngine on
SSLProxyEngine On
SSLCertificateFile /usr/local/apache/conf/server.crt
SSLCertificateKeyFile /usr/local/apache/conf/server.key
<Proxy balancer://mycluster>
BalancerMember http://1.2.3.1:80
BalancerMember http://1.2.3.2:80
# technically we aren't blocking anyone, but could here
Order Deny,Allow
Deny from none
Allow from all
# Load Balancer Settings
# A simple Round Robin load balancer.
ProxySet lbmethod=byrequests
</Proxy>
# balancer-manager
# This tool is built into the mod_proxy_balancer module allows you
# to do simple mods to the balanced group via a gui web interface.
<Location /balancer-manager>
SetHandler balancer-manager
Order deny,allow
Allow from all
</Location>
ProxyRequests Off
ProxyPreserveHost On
# Point of Balance
# Allows you to explicitly name the location in the site to be
# balanced, here we will balance "/" or everything in the site.
ProxyPass /balancer-manager !
ProxyPass / balancer://mycluster/ stickysession=JSESSIONID
</VirtualHost>
What I need is for the servers in my load balancer to be
BalancerMember https://1.2.3.1:443
BalancerMember https://1.2.3.2:443
But that does not work. I get SSL negotiation errors.
Even when I do get that to work, I will need to pass client certificates.
Any help would be appreciated.
