2

I have an Ubuntu 14 LTS / Apache 2.4 server with mod_proxy/mod_rewrite configured for use as a reverse proxy. One of the servers on the backside is too old to support TLS. I would like to disable SSL as an option for clients communicating with the proxy on the front side while still allowing the proxy to communicate with the old server using SSL on the back side.

Is this possible?

Improve this question

1 Answer 1

Reset to default
0

The solution is actually embarrassingly simple.

The cipher/protocol settings for how clients can connect to the reverse proxy do not effect how the reverse proxy negotiates a connection to a back-end server.

In other words, I was able to disable SSL and harden the cipher's on the reverse proxy and the reverse proxy was still able to use the weaker protocols to connect to the old back-end server.

For the curious, these are the settings I used in the /etc/apache2/mods-enabled/ssl.conf file on my Ubuntu 14.04 LTS server running Apache 2.4.7 to disable SSL and harden the cipher's used:

SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
SSLHonorCipherOrder On
SSLProtocol all -SSLv3
# NOTE: Do not add -SSLv2 as some sites suggest (It's already not supported)
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .