配置 HTTPS 正向代理时出错（AH02268：下游服务器需要客户端证书，但未配置）

Question

I think I'm doing several mistakes together, but I'm stuck and I'm going out crazy. And I guess the question has already been posed, but, even searching a lot, I could not find this exact case posted anywhere.

The task I'm working to is calling a remote HTTPS server through a proxy:

wget http://localhost/remote?wsdl

points to

https://someserver.com/service?wsdl

In a diagram:

       (http)            (https)
client ------> localhost -------> someserver.com

Using the wonderful Apache web server (really, not kidding).

The certificate exchange occurs between the proxy and the remote server and I already installed the client certificate with the private key onboard of the proxy. The customer gave me the certificates in a .p12 file.

Trying to test the wanted webservice with SoapUI and the same certificates, I got the expected behavior (everything is working fine). But now I have to call services from a middleware. For this I'm configuring a SSL Proxy with Apache.

I tried to do this in 2 ways, both unsuccessful:

1) Defining a proxy and defining the SSL parameters respectively in two files:

/etc/apache2/conf.d/mods-available/ssl.conf
/etc/apache2/conf.d/mods-available/proxy.conf

The first file contains:

# /etc/apache2/conf.d/mods-available/ssl.conf
SSLPassPhraseDialog  exec:/usr/local/etc/apache2/pwf.sh # to avoid manuallly entering passphrase
SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout  300

SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin

ErrorLog /var/log/ssl_error_log
TransferLog /var/log/ssl_access_log
LogLevel warn

SSLEngine off
SSLProtocol all -SSLv2

SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES
SSLCertificateFile /usr/local/etc/apache2/ssl.crt/certificate.pem
SSLCertificateKeyFile /usr/local/etc/apache2/ssl.key/server.key
SSLCertificateChainFile /usr/local/etc/apache2/ssl.crt/chain.pem

CustomLog /var/log/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

And the second file contains:

# /etc/apache/conf.d/mods-available/proxy.conf
SetEnv proxy-sendcl 1

SSLProxyEngine On

ProxyPass /remote https://someserver.com/service
ProxyPassReverse /remote https://someserver.com/service

I enabled these modules via:

sudo a2enmod proxy & a2enmod ssl

2) Defining a Virtual Host

/etc/apache2/conf.d/sites-available/remote.conf 

this method being mutually exclusive with the previous way:

# 
# remote.local
<VirtualHost SOMEIP:443>

    ProxyRequests on
    DocumentRoot /var/www/html/remote

    ServerName someserver.com

    SSLEngine on
    SSLProxyEngine on
    SSLCertificateFile /usr/local/etc/apache2/ssl.crt/certificate.pem
    SSLCertificateKeyFile /usr/local/etc/apache2/ssl.key/server.key
    SSLCertificateChainFile /usr/local/etc/apache2/ssl.crt/chain.pem
    ProxyPreserveHost On

    ErrorLog ${APACHE_LOG_DIR}/error_remote.log
    CustomLog ${APACHE_LOG_DIR}/access_remote.log combined

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel info

    <Location /remote>
        ProxyPass https://someserver.com/service
        ProxyPassReverse https://someserver.com/service
        Order allow,deny
        Allow from all
    </Location>

</VirtualHost>

I enabled this with:

sudo a2ensite remote

In any of the two ways I try, I get these (identical) errors when I try to access the local URL:

[Thu Jun 11 18:39:15.724705 2020] [ssl:warn] [pid 30578] AH02268: Proxy client certificate callback: (localhost:80) downstream server wanted client certificate but none are configured
[Thu Jun 11 18:39:15.794381 2020] [proxy_http:error] [pid 30578] (20014)Internal error (specific information not available): [client ::1:49118] AH01102: error reading status line from remote server someserver.com:443
[Thu Jun 11 18:39:15.794585 2020] [proxy:error] [pid 30578] [client ::1:49118] AH00898: Error reading from remote server returned by /remote/

The chain of certificates is OK:

openssl crl2pkcs7 -nocrl -certfile chain.pem | openssl pkcs7 -print_certs -noout

Shows me all the certificate issuer and subject for CA, intermediate and server certificate:

openssl verify -CAfile ca.pem -untrusted chain.pem certificate.pem 

certificate.pem: OK

Any suggestion will be appreciated, thanks in advance.

Answer 1

I missed to configure the certificate for the Reverse Proxy, namely the section

SSLProxyMachineCertificateFile