Apache: Reverse proxy to a website in a virtual machine with HTTPS

[Verhoeckx]

Hello Cockpit developers,

Is there somebody here who know how to configure a reverse proxy to a website, running in a virtual machine, with HTTPS?

My set-up
A RHEL server (host) with one virtual machine.
The website is running on the virtual machine (also RHEL).

I belief this is a common set-up so I think there must be an (easy) solution?

Virtual host file on the server / host

ServerName localhost
DocumentRoot /var/www/html/

<VirtualHost *:80 >
    ServerName nextcloud.jeroenverhoeckx.com
    ProxyPreserveHost On
    ProxyPass / http://192.168.122.246/
    ProxyPassReverse / http://192.168.122.246/
</VirtualHost>

<VirtualHost *:443 >
    ServerName nextcloud.jeroenverhoeckx.com
    SSLProxyEngine on
    ProxyPreserveHost On
    ProxyPass / https://192.168.122.246/
    ProxyPassReverse / https://192.168.122.246/
</VirtualHost>

Virtual host file on the virtual machine

ServerName localhost
DocumentRoot /var/www/html/

<VirtualHost *:80 >
    ServerName nextcloud.jeroenverhoeckx.com 
    DocumentRoot /var/www/html/
    RewriteEngine on
    RewriteCond %{SERVER_NAME} =nextcloud.jeroenverhoeckx.com
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:443>
    ServerName nextcloud.jeroenverhoeckx.com 
    DocumentRoot /var/www/html/
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/nextcloud.jeroenverhoeckx.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/nextcloud.jeroenverhoeckx.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>

Problem
When I go to the domain (https://nextcloud.jeroenverhoeckx.com), Firefox still tells me that the website isn't secure.

Question
What do I need to add to the virtual host file on the host to correctly pass all HTTPS traffic to the virtual host on the virtual machine? Ideally (if possible) I don't request for another SSL certificate or copy the certificate on the virtual machine to the host.

I'm documenting all the steps on a blog post so others can repeat the steps that I make. You can find this blog post here (work in progress / draft). In the blog I will make some advertisement for Cockpit 😃.

Any help is appreciated! I searched on the internet but couldn't find any good documentation.

Verhoeckx

[Verhoeckx]

I think I know what the problem is: I installed the certificate on the virtual machine because that's where I also installed Nextcloud.
But according to this article I have to install it on the host (which also seem logical).

I'm going to try that!

[Verhoeckx]

Yes it works!

I installed the SSL-certificate on the host (with Let's Encrypt) and now it works correctly 🥳 !!

Here is the final virtual host file:

ServerName localhost
DocumentRoot /var/www/html/

<VirtualHost *:80 >
    ServerName [your.domain.com]
    RewriteEngine on
    RewriteCond %{SERVER_NAME} =[your.domain.com]
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:443 >
    ServerName [your.domain.com]
    ProxyPreserveHost On
    ProxyPass / http://[IP address virtual machine]/
    ProxyPassReverse / http://[IP address virtual machine]/
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/[your.domain.com]/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/[your.domain.com]/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
    <IfModule mod_headers.c>
      Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
    </IfModule>
</VirtualHost>

The exact steps that I took can be found on this blog (see the section Install Nextcloud) (draft).