1

This is my setup :

Server 1 = Nginx is receiving the request on port 443 and is used as a reverse proxy to send it to Varnish 5, on the same server on port 80.

Varnish is load balancing requests on servers 2 and 3 (which are identical) on port 443.

Server 2 & 3 = Apache is receiving the requests on port 443 and access to the app.

SSL certificates are installed on all servers.

When I try to access the website I have this error 400:

Your browser sent a request that this server could not understand. Reason: You're speaking plain HTTP to an SSL-enabled server port. Instead use the HTTPS scheme to access this URL, please.

Here are my configs :

Nginx :

server {
   listen 443 ssl;

   server_name server.mydomain.com;

   ssl_certificate /etc/letsencrypt/live/server.mydomain.com/fullchain.pem;
   ssl_certificate_key/etc/letsencrypt/live/server.mydomain.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:80;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Port 443;
        proxy_set_header X-Secure on;
    }
 }

Varnish:

backend server1 { 
  .host = "xx.xx.xx.xxx";
  .port = "443";
}

backend server2 { 
  .host = "xx.xx.xx.xxx";
  .port = "443";
}


sub vcl_recv {
  if (req.restarts == 0) {
    if (req.http.x-forwarded-for) {
           set req.http.X-Forwarded-For =
               req.http.X-Forwarded-For + ", " + client.ip;
       } else {
           set req.http.X-Forwarded-For = client.ip;
       }
   }

   if (req.http.X-Real-IP) {
       set req.http.X-Forwarded-For = req.http.X-Real-IP;
   } else {
       set req.http.X-Forwarded-For = client.ip;
   }
   ...
}

Apache:

<VirtualHost *:443>
    ServerName server.mydomain.com

   DocumentRoot /var/www/mydomain/

    <Directory /var/www/mydomain/>
            AllowOverride All
            Order allow,deny
            allow from all
    </Directory>

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/server.mydomain.com/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/server.mydomain.com/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/server.mydomain.com/chain.pem

    SSLProtocol all -SSLv2 -SSLv3
    SSLHonorCipherOrder on
    SSLCompression off
    SSLOptions +StrictRequire
    SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-E$

    LogLevel warn
    ErrorLog ${APACHE_LOG_DIR}/server.mydomain.com-error.log
    CustomLog ${APACHE_LOG_DIR}/server.mydomain.com-access.log combined

</VirtualHost>

I understand the problem, but didn't find he solution. Any advice?

Regards

  • I don’t suppose you work with this person? unix.stackexchange.com/q/435578/117549 (posted earlier today) – Jeff Schaller Apr 5 '18 at 2:56
  • No, I don't, this is a different issue – GregOs Apr 5 '18 at 3:23
  • The problem is that apache is receiving an uncrypted http source on his 443 port. That causes the 400. I need to figure out how to encrypt the message between varnish and apache, because varnish is not handling ssl. – GregOs Apr 5 '18 at 4:58
  • I understand Apache2, there my knowledge ends, would this help: bash-prompt.net/guides/apache-varnish – Vlastimil Apr 5 '18 at 5:12
  • thanks, this is basically what I did, but using nginx as a reverse proxy between the client and varnish. My problem is that I also use varnish as a load balancer, and the traffic is distributed between two external apache servers, in http, which is not secured : I need to load balance in https. – GregOs Apr 5 '18 at 7:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.