Bug 64310 - proxy wstunnel does not use SSLProxyMachineCertificateFile
Summary: proxy wstunnel does not use SSLProxyMachineCertificateFile
Status: NEW
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_proxy_wstunnel (show other bugs)
Version: 2.4.37
Hardware: PC All
: P2 normal (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-04-06 08:03 UTC by Richard Hardy
Modified: 2020-04-06 19:07 UTC (History)
0 users



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Richard Hardy 2020-04-06 08:03:38 UTC
When proxying to a server that requires mutual SSL, the https proxy pass connections work as expected, but wss connections do not pass the client certificate

eg.
	SSLProxyCACertificateFile myapp/ca.crt
        SSLProxyVerify require
        SSLProxyCheckPeerCN off
	SSLProxyCheckPeerName off

        SSLProxyMachineCertificateFile myapp/proxy-user.pem
	ProxyPreserveHost On

	ProxyPass /websocket wss://wlg-myapp-docker-dev-01.co.nz:443/websocket
        ProxyPass         /  https://wlg-myapp-docker-dev-01.co.nz:443/
        ProxyPassReverse  /  https://wlg-myapp-docker-dev-01.co.nz:443/


The next hop is the nginx ingress router in kubernetes, which is helpful because it gives useful feedback regarding client certificates

 requests for /websocket get back
<head><title>400 No required SSL certificate was sent</title></head>

from kubernetes, all other requests that are matched by the https:// proxy pass are handled correctly
Comment 1 Ruediger Pluem 2020-04-06 15:16:58 UTC
Any messages in the httpd error log?
Comment 2 Richard Hardy 2020-04-06 19:07:01 UTC
No, just the usual startup messages and a warning about the SSL server certificate that I am using.