Hi SF'ers!

We recently moved an exchange server behind a reverse proxy due to the loss of a public IP. I've managed to configure the reverse proxy (httpd proxy_http).

But there is a problem for the SSL configuration.

When accessing the OWA interface with Firefox, all is ok and working. When accessing with MSIE or Chrome, they do not retrieve the good SSL Certificate.

I think this is due to the multiples virtual host for httpd. Is there a workaround to make sure MSIE/Chrome request the certificate for the good domain name like FF does?

Already tested with the SSL virtual host :

SetEnvIf User-Agent ".*MSIE.*" value BrowserMSIE
  Header unset WWW-Authenticate
  Header add WWW-Authenticate "Basic realm=exchange.domain.com"

A:

ProxyPreserveHost On

also:

BrowserMatch ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0

Or:

SetEnvIf User-Agent ".*MSIE.*"    \
nokeepalive ssl-unclean-shutdown  \
downgrade-1.0 force-response-1.0

And lots of ProxyPassand ProxyReversePath on /exchweb /exchange /public etc...

And it still don't seem to work. Any clue?

Thanks.

Edit 1: Precision of versions

# openssl version
OpenSSL 0.9.8k-fips 25 Mar 2009

/usr/sbin/httpd -v
Server version: Apache/2.2.11 (Unix)
Server built:   Mar 17 2009 09:15:10

Browser versions :

MSIE : 8.0.6001
Opera: Version 11.01 Revision 1190
Firefox: 3.6.15
Chrome: 10.0.648.151

Operating System:

Windows Vista 32bits.

They are all SNI compliant, I've tested them this afternoon https://sni.velox.ch/

You're right Shane Madden, I have multiple sites on the same public IP (and same port as well). The server itself is just a reverse proxy, that rewrite addresses to internal servers.

The default host is a dev site, configure with the certificate that does not match the OWA (of course... would have been to easy)

<VirtualHost *:443>
    ServerName dev2.domain.com
    ServerAdmin [email protected]


    CustomLog "| /usr/sbin/rotatelogs /var/log/httpd/access-%y%m%d.log 86400" combined
    ErrorLog "| /usr/sbin/rotatelogs /var/log/httpd/error-%y%m%d.log 86400"

    LogLevel warn

    RewriteEngine on
    SetEnvIfNoCase X-Forwarded-For .+ proxy=yes

    SSLEngine on
    SSLProtocol -all +SSLv3 +TLSv1
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL:+SSLv3
    SSLCertificateFile /etc/httpd/ssl/domain.com.crt
    SSLCertificateKeyFile /etc/httpd/ssl/domain.com.key


    RewriteCond %{HTTP_HOST} dev2\.domain\.com
    RewriteRule ^/(.*)$ http://dev2.domain.com/$1 [L,P]

</VirtualHost>

The certificate of domain is a *.domain.com

The second vHost is :

<VirtualHost *:443>
    ServerName exchange.domain2.com
    ServerAdmin [email protected]


    CustomLog "| /usr/sbin/rotatelogs /var/log/httpd/exchange/access-%y%m%d.log 86400" combined
    ErrorLog "| /usr/sbin/rotatelogs /var/log/httpd/exchange/error-%y%m%d.log 86400"

    LogLevel warn

    SSLEngine on
    SSLProxyEngine On

    SSLProtocol -all +SSLv3 +TLSv1
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL:+SSLv3
    SSLCertificateFile /etc/httpd/ssl/exchange.pem
    SSLCertificateKeyFile /etc/httpd/ssl/exchange.key
   RewriteEngine on
    SetEnvIfNoCase X-Forwarded-For .+ proxy=yes

    RewriteCond %{HTTP_HOST} exchange\.domain2\.com
    RewriteRule ^/(.*)$ https://exchange.domain2.com/$1 [L,P]

</VirtualHost>

and it's certificate is exchange.domain2.com only.

I presume the SNI is somewhere not activated on my server. The versions of openssl and apache seams to be ok for the SNI support. The only thing I do not know is if httpd has been compile with the good options. (I assume it's a fedora packet).