title: Apache ProxyPass HTTPS and remote server with SNI
body: <p>I'm wanting to front an AWS APIGateway URL with a reverse proxy in Apache. The reason is due to a process requiring a static IP to provision a service behind a strict firewall and that the current infrastructure has mod_proxy already in place. The solution I'm looking to implement is to simply to route https->https(apiGateway) via mod_proxy.</p>
  
  <p>But.. AWS uses SNI and I can not get mod_proxy to handshake.</p>
  
  <p>I have the following settings enabled  </p>
  
  <pre><code>&lt;IfModule mod_ssl.c&gt;
  &lt;VirtualHost *:443&gt;
    ProxyPreserveHost On
    SSLProxyEngine On
  
    ProxyPass /api/1_0/ https://xxx.execute-api.eu-west-1.amazonaws.com/1_0/
    ProxyPassReverse /api/1_0/ https://xxx.execute-api.eu-west-1.amazonaws.com/1_0/
  </code></pre>
  
  <p>The following logs are available in debug mode</p>
  
  <pre><code>proxy_util.c(2020): AH00942: HTTPS: has acquired connection for (xxx.execute-api.eu-west-1.amazonaws.com)
  proxy_util.c(2610): AH00962: HTTPS: connection complete to 52.x.x.x:443 (xxx.execute-api.eu-west-1.amazonaws.com)
  AH01964: Connection to child 0 established (server domain.com:443)
  AH02003: SSL Proxy connect failed
  SSL Library Error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
  AH01998: Connection closed to child 0 with abortive shutdown (server domain.com:443)
  AH01997: SSL handshake failed: sending 502
  </code></pre>
  
  <p>If I connect using openssl, I can demonstrate a similar error </p>
  
  <pre><code>openssl s_client -tls1_2 -connect xxx.execute-api.eu-west-
  1.amazonaws.com:443
  CONNECTED(00000003)
  140735866254216:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert 
  handshake failure:s3_pkt.c:1494:SSL alert number 40
  140735866254216:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659:
  </code></pre>
  
  <p>adding -servername for SNI, results in a valid connection </p>
  
  <pre><code>SSL handshake has read 3601 bytes and written 489 bytes
  ---
  New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
  ...
  </code></pre>
  
  <p>I therefore believe that mod_proxy and mod_ssl are not sending the servername to the remote https server and could be a bug. </p>
  
  <p>I am running Ubuntu 14.04 with 
  Server version: Apache/2.4.7 (Ubuntu)
  Server built:   Sep 18 2017 16:37:54
  OpenSSL 1.0.1f 6 Jan 2014</p>
  
  <p>I have attempted to limit the <code>SSLProxyProtocol</code> to TLS1_2 and the cipher list too however the sslv3 alert handshake failure log still exists regardless. </p>
  
  <p>Has any one come across this and know how to ensure that the SNI values are being sent or is this a restriction in the Apache modules?</p>