Configuring Apache for Proxy SSL

Objective

By the end of this lesson, you will learn how to:

• Configure Apache 2 to listen on a new HTTPS port (5051).
• Obtain and install an SSL certificate for your domain (store.hngamers.com).
• Set up Apache to forward all HTTPS traffic on port 5051 to an unsecured HTTP service running on port 5000.

Prerequisites

1. Basic understanding of Apache configuration.
2. Access to Apache configuration files and administrative privileges.
3. An active HTTP service running on port 5000 (e.g., a backend application).
4. Domain name (store.hngamers.com) pointing to your server’s IP address.

Lesson Content

Introduction to Port Forwarding, SSL, and Apache Configuration

• Port Forwarding and Reverse Proxying:

  Port forwarding allows external clients to connect to a service within a server by mapping an external port to an internal port. Apache can act as a reverse proxy, forwarding client requests to backend services.

• SSL/TLS and HTTPS:

  SSL/TLS certificates encrypt data between the client and server, ensuring secure communication. HTTPS is HTTP over SSL/TLS.

• Apache as a Web Server and Reverse Proxy with SSL:

  Apache can serve web content, manage SSL certificates, and act as a reverse proxy to secure backend services.

Step 1: Create a Non-SSL Apache Virtual Host for store.hngamers.com

1.1 Create the Virtual Host Configuration File

Create a new Apache configuration file:

1.2 Add the Following Configuration

Explanation:

• <VirtualHost *:80>: Listens on port 80 (HTTP).
• ServerName: Your domain name.
• DocumentRoot: Directory containing your site’s files.
• ErrorLog and CustomLog: Log file locations.
• <Directory> Block: Sets directory permissions.

1.3 Create the Document Root Directory

1.4 Enable the Site and Required Modules

1.5 Reload Apache

1.6 Test the Configuration

• Open a browser and navigate to http://store.hngamers.com.
• You should see the “Welcome to store.hngamers.com” message.

Step 2: Obtain an SSL Certificate for store.hngamers.com Using Let’s Encrypt

2.1 Install Certbot

2.2 Obtain and Install the SSL Certificate

During the process:

• Email Address: Enter your email.
• Terms of Service: Agree to proceed.
• Select Domain: Ensure store.hngamers.com is selected.
• Redirect Option: Choose whether to redirect HTTP to HTTPS.

2.3 Verify SSL Certificate Installation

• Navigate to https://store.hngamers.com.
• Confirm that the SSL certificate is valid.

Step 3: Configure Apache to Listen on Port 5051 with SSL and Proxy to Port 5000

3.1 Modify the Apache Virtual Host Configuration

Edit the SSL configuration file:

3.2 Update the Configuration

Replace the existing content with:

<IfModule mod_ssl.c>
<VirtualHost *:5051>
    ServerName store.hngamers.com
    DocumentRoot /var/www/store.hngamers.com

    ErrorLog ${APACHE_LOG_DIR}/store_error.log
    CustomLog ${APACHE_LOG_DIR}/store_access.log combined

    # Enable SSL
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/store.hngamers.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/store.hngamers.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf

    # Reverse Proxy Configuration
    ProxyRequests Off
    ProxyPass / http://localhost:5000/
    ProxyPassReverse / http://localhost:5000/

    <Proxy *>
        Require all granted
    </Proxy>

    # Compression (optional)
    <IfModule mod_brotli.c>
        AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css text/javascript application/javascript application/json application/x-font-ttf application/vnd.ms-fontobject image/x-icon
    </IfModule>
</VirtualHost>
</IfModule>

Explanation:

• Changed <VirtualHost *:443> to <VirtualHost *:5051> to listen on port 5051.
• Added reverse proxy settings to forward requests to http://localhost:5000/.

3.3 Update ports.conf to Listen on Port 5051

Edit the ports.conf file:

Add:

3.4 Enable Necessary Apache Modules

3.5 Restart Apache

3.6 Adjust Firewall Settings

Allow traffic on port 5051:

Step 4: Test the New Configuration

4.1 Access the Site

Navigate to:

4.2 Verify SSL Certificate

• Ensure the SSL certificate is valid for store.hngamers.com.
• No SSL warnings should appear.

4.3 Check Content Delivery

• Confirm that the content served is from the service running on port 5000.
• Test functionality to ensure proper operation.

Step 5: (Optional) Redirect HTTP Traffic to HTTPS

To redirect all HTTP traffic on port 80 to HTTPS on port 5051:

5.1 Modify the Non-SSL Virtual Host

Edit the configuration:

Add the following within the <VirtualHost *:80> block:

Ensure mod_rewrite is enabled:

5.2 Reload Apache

5.3 Test the Redirection

• Navigate to http://store.hngamers.com.
• You should be redirected to https://store.hngamers.com:5051.

Conclusion and Troubleshooting Tips

Recap of Steps

• Created a non-SSL site for store.hngamers.com on port 80.
• Obtained an SSL certificate using Let’s Encrypt.
• Configured Apache to listen on port 5051 with SSL, proxying to port 5000.
• Tested the configuration to ensure it’s working.
• Optional: Redirected HTTP traffic to HTTPS.

Common Troubleshooting Tips

• Site Not Accessible on Port 5051
  • Ensure Apache is listening on port 5051.
  • Verify firewall settings to allow port 5051.
  • Check that the backend service on port 5000 is running.
• SSL Certificate Issues
  • Confirm the certificate is correctly installed.
  • Ensure the domain name matches the certificate.
  • Check the certificate’s validity period.
• Proxy Errors
  • Verify that proxy and proxy_http modules are enabled.
  • Ensure the ProxyPass directives point to the correct backend service.
• Apache Configuration Errors
  • Test configuration syntax:
    sudo apachectl configtest

  • Review Apache logs for errors:
    sudo tail /var/log/apache2/error.log


Assignment

1. Implement the Described SSL Port Forwarding Setup on Your Apache Server
   • Follow the steps to configure Apache, obtain an SSL certificate, and set up reverse proxying.
2. Test the Setup by Accessing https://store.hngamers.com:5051
   • Ensure the site loads securely and proxies to the service on port 5000.
3. Document Any Challenges and How You Overcame Them
   • Record any issues and their solutions for future reference.

Additional Resources

• Apache Official Documentation:

  Apache HTTP Server Documentation

• Let’s Encrypt Certbot Instructions:

  Certbot Documentation

• Apache mod_proxy Module:

  mod_proxy Documentation

• Apache mod_ssl Module:

  mod_ssl Documentation

Feedback and Support

• Apache Community Forums:

  Apache HTTP Server Users Mailing List

• Let’s Encrypt Community Support:

  Let’s Encrypt Community Forum

• Consult a Network Administrator

  If issues persist, seek assistance from a professional.

Through this lesson, you have learned how to configure Apache 2 to securely forward traffic using SSL certificates, enhancing the security and reliability of your web services.

Happy Configuring!

Note: Replace store.hngamers.com and file paths with your actual domain and server configuration. Ensure all commands are executed with appropriate permissions.