title: Possible to serve SSL/TLS Certificate from internal server using Apache as Reverse Proxy?
body: <p>I have a Windows Server accesible through an public IP with some Apache Virtual Hosts configured to proxy pass to various internal servers with web applications and services (Apache acting as a reverse proxy). On one of the internal servers I want to configure HTTPS using letsencrypt. </p>
  
  <p>I managed to get an working certificate and server configuration on the internal server, but the problem is my Reverse Proxy (Apache) not wanting to tunnel this HTTPS traffic.</p>
  
  <p>Edit: I know it would be easier to configure the Reverse Proxy with the certificates but Let's Encrypt has no good automated options for Windows yet and manually changing the certificates every 60 days or so would be really tedious.</p>
  
  <p>The Virtual Host configuration in Apache 2.4 (Windows) looks like this:</p>
  
  <pre><code>&lt;VirtualHost *:443&gt;
      ServerName somesubdomain.mydomain.com
      DocumentRoot "E:/Apache2/htdocs"
      DirectoryIndex index.html
  
      ProxyRequests Off
      &lt;Proxy *&gt;
         Order deny,allow
         Allow from all
      &lt;/Proxy&gt;
  
     ProxyPreserveHost On 
  
     ProxyPass /  https://10.3.1.83/
     ProxyPassReverse /   https://10.3.1.83/
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>On the 10.3.1.83 (Ubuntu/Nginx) using the certbot from letsencrypt, I generated valid certificates and configured Nginx to serve HTTPS plus the certificates.</p>
  
  <p>When I access the Ubuntu/Nginx Server from inside the LAN, everything works as excpect. Using Chrome DevTools I can verify it servers the right LetsEncrypt Certificate.</p>
  
  <p>Accessing the corresponding subdomain from the outside (Internet) it returns an Internal Server Error Page and in the logs Apache tells me the following: </p>
  
  <pre><code>AH00961: HTTPS: failed to enable ssl support for 10.3.1.83:443 (10.3.1.83)
  </code></pre>
  
  <p>Edit: Finally I found some answers:
  Seems like SNI proxing is not implemented in Apache, only "SNI virtual hosting". One could use HAProxy or other projects though.</p>
  
  <p><a href="https://stackoverflow.com/questions/24125954/apache-https-reverse-proxy-with-sni-without-key-on-the-proxy">Apache HTTPS reverse proxy with SNI without key on the proxy</a>
  <a href="https://serverfault.com/questions/614806/apache-mod-proxy-with-https-without-key-material-using-sni">https://serverfault.com/questions/614806/apache-mod-proxy-with-https-without-key-material-using-sni</a>
  <a href="https://serverfault.com/questions/625362/can-a-reverse-proxy-use-sni-with-ssl-pass-through/625364">https://serverfault.com/questions/625362/can-a-reverse-proxy-use-sni-with-ssl-pass-through/625364</a></p>