Tomcat – Apache + mod_jk + remote Tomcat – Is this safe

apache-2.2tomcat

I have configured Apache on local server (Server1) and Apache Tomcat on remote server (Server2). Apache works with mod_jk connector that redirect requests to remote Tomcat. Both working on SSL. Is this configuration is safe and use encryption beetween Server1 and remote Server2 ?

workers.properties

worker.ajp13.type=ajp13
worker.ajp13.host=<REMOTE_IP>
worker.ajp13.port=8009

Best Answer

Let say you have your public server on: public.example.com:443

And your private server on: private.example.com:8443

Your apache configuration should look like:

<VirtualHost *:443>
ServerName public.example.com
SSLEngine on
SSLProxyEngine on 
ProxyPass / https://private.example.com:8443/
ProxyPassReverse / https://private.example.com:8443/

#Common SSL configuration
DirectoryIndex index.php index.html index.htm index.shtml
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn  
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
SSLCertificateFile /etc/ssl/startssl/ssl.crt
SSLCertificateKeyFile /etc/ssl/startssl/ssl.key
SSLCACertificateFile /etc/ssl/startssl/sub.class1.server.ca.pem
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>
Related Topic