title: configure secure SSL Apache reverse proxy
body: <p>I'm trying to establish a reverse proxy setup with apache that securely supports SSL all the way through:</p>
  <pre><code>Client   &lt;--&gt;   Proxy @ somehostname.com   &lt;--&gt;   Server @ 123.45.67.89
  </code></pre>
  <p>Note that my proxy server has a hostname, but the remote server does not. The SSL setup between clients and the proxy works fine with a letsencrypt setup. However, I am struggling to secure the connection between the proxy and the remote server.</p>
  <p>Because the remote server doesn't have a hostname, and letsencrypt doesn't issue certificates for IPs only, my idea was to generate a self-signed certificate and copy the certificate over to the proxy for it to only trust that one. Unfortunately I don't know how.</p>
  <p>If I just disable these certificate checks, the connection works, as the proxy just trusts every certificate:</p>
  <pre><code>SSLProxyCheckPeerCN off
  SSLProxyCheckPeerName off
  </code></pre>
  <p>While encryption will work fine, to my understanding authenticity is compromised and I am subject to MitM attacks during the handshake. This is not ideal.</p>
  <p>Instead, I've instructed Apache to trust my self-signed certificate with</p>
  <pre><code>SSLProxyCACertificateFile /path/to/cert.pem
  </code></pre>
  <p>and then tried to enforce a valid certificate with</p>
  <pre><code>SSLProxyVerify require
  </code></pre>
  <p>but despite me explicitly listing the certificate, and the documentation of <a href="http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslproxycacertificatefile" rel="nofollow noreferrer"><code>SSLProxyCACertificateFile</code></a> saying &quot;These are used for Remote Server Authentication&quot;, it seems to not trust it.</p>
  <p>Is there a way to make sure the connection between the proxy and remote server is safe, for example by enforcing Apache to always connect to the proxy using that specific certificate?</p>