I have a Java application that needs to talk to another intranet website using HTTPS in both directions. After fighting with Java's SSL implementations for some time, I gave up on that, and have now set up an Apache that's supposed to act as a bidirectional reverse proxy:

external app ---(HTTPS request)---> Apache ---(local HTTP request)---> Java app

This direction works just fine, however the other direction does not:

Java app ---(local HTTP request)---> Apache ---(HTTPS request)---> external app

This is the configuration for the vhost implementing the second proxy:

Listen 127.0.0.1:8081

<VirtualHost appgateway:8081>
   ServerName appgateway.local

   SSLProxyEngine on
   ProxyPass        / https://externalapp.corp:443/
   ProxyPassReverse / https://externalapp.corp:443/
   ProxyRequests Off
   AllowEncodedSlashes On

   # we do not need to apply any more restrictions here, because we listened on
   # local connections only in the first place (see the Listen directive above)
   <Proxy https://externalapp.corp:443/*>
      Order deny,allow
      Allow from all
   </Proxy>
</VirtualHost>

A curl http://127.0.0.1:8081/ should serve the equivalent of https://externalapp.corp, but instead results in 403 Forbidden, with the following message in the Apache error log:

[Wed Jun 04 08:57:19 2014] [error] [client 127.0.0.1] Directory index forbidden by Options directive: /srv/www/htdocs/

This message completely puzzles me: Yes, I have not set up any permissions on the DocumentRoot of this vhost, but everything works fine for the other proxy direction where I haven't. For reference, here's the other vhost:

Listen this_vm_hostname:443

<VirtualHost javaapp:443>
   ServerName javaapp.corp

   SSLEngine on
   SSLProxyEngine on
   # not shown: SSLCipherSuite, SSLCertificateFile, SSLCertificateKeyFile
   SSLOptions +StdEnvVars

   ProxyPass        / http://localhost:8080/
   ProxyPassReverse / http://localhost:8080/
   ProxyRequests Off
   AllowEncodedSlashes On

   # Local reverse proxy authorization override
   <Proxy http://localhost:8080/*>
      Order deny,allow
      Allow from all
   </Proxy>
</VirtualHost>