SSL on internal network

Nikolaj

4/28/24, 7:38 AM

I have a firewall (connected to the internet) with mod_proxy installed on apache. Behind the firewall I have several web-servers running. The issue here is SSL. I like to have everything on SSL, also on the internal network for many reasons. One of the reasons is that webserver may kind of stall on use because browser client sees the server as none-SSL. So I just wanna make sure that everything is under SSL.

I am running Ubuntu 22.04, apache 2.4

Firewall apache conf looks like this:

<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName my.domain.com

ProxyPreserveHost On
ProxyPass / http://192.168.1.85/
ProxyPassReverse / http://192.168.1.85/

    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/letsencrypt/live/my.domain.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/my.domain.com/privkey.pem
</VirtualHost>

The web-server "behind", looks like this:

<VirtualHost *:80>
    ServerAdmin [email protected]
    DocumentRoot /var/www/html

    ServerName my.domain.com

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

I use Bind as internal DNS software (working fine) :) I am unsure how to do the SSL between firewall and web-server behind firewall. Hope I can get some help on this :)

I am using letsencrypt, but could also use anything else (longer term SSL), since this is an internal and secure network.

IF possible........I would very much like to (not have) an apache running on the firewall. I don't know if that is possible. The issue though is that I will have several web-servers so I cant just forward the ports.......but a thought on that would be very welcome! :)

Looking forward to hear from you all.

0 + 4

firewall

ssl

apache2

matigo

4/28/24, 8:08 AM

Is the root `domain.com` a domain that you own and have registered with a proper registrar? Or is this something that exists only on your internal network? The answer to this question will determine what sort of answer you can receive ...

Nikolaj

4/28/24, 8:35 AM

Just a fictive domain :)

Nikolaj

4/28/24, 9:15 AM

But I have an actual (correct) domain.............working, dns name and everything......

matigo

4/28/24, 9:31 AM

Your two comments seem to contradict each other. SSL certificates are not transportable and must be made for a specific domain (or set of domains) that are accessible on the public web. If you are using a public domain, such as `nikolaj.com` on your local network, then there is a reasonably simple way to have SSL certificates created. If you're using a fictional domain, such as `website.nikolaj`, then the only option will be a self-signed certificate, which browsers often complain about.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: SSL on internal network

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.