# Proxying to older apache fails

**URL:** <https://www.ruby-forum.com/t/proxying-to-older-apache-fails/241700>\
**Category:** NGINX\
**Created:** [April 24, 2015, 7:28am UTC](https://www.ruby-forum.com/t/proxying-to-older-apache-fails/241700 "2015-04-24T07:28:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Detlef\_R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/58f4c7/32.png) [@Detlef\_R](https://www.ruby-forum.com/u/Detlef_R)\
**Post date:** [April 24, 2015, 7:28am UTC](https://www.ruby-forum.com/t/proxying-to-older-apache-fails/241700/1 "2015-04-24T07:28:49Z")

</div>

I’m trying to keep an old apache install limping along for a few more  
months  
by letting nginx handle the SSL connection between site visitors and  
apache.

I have a pretty simple config on the nginx side for the proxy\_pass  
config;

location / {  
proxy\_pass [https://foo.i.example.com](https://foo.i.example.com);  
proxy\_set\_header Host $host;  
proxy\_set\_header X-Real-IP  
$remote\_addr;  
proxy\_send\_timeout 360;  
proxy\_read\_timeout 360;  
}

I see the request hit the apache side, and with some debugging enabled,  
I’m  
able to get some detail:

[Fri Apr 24 01:21:48 2015] [info] Initial (No.1) HTTPS request received  
for  
child 6 (server [signup.biglist.com:443](http://signup.biglist.com:443))  
[Fri Apr 24 01:21:48 2015] [debug] ssl\_engine\_kernel.c(400): [client  
10.99.88.59] Reconfigured cipher suite will force renegotiation  
[Fri Apr 24 01:21:48 2015] [info] [client 10.99.88.59] Requesting  
connection  
re-negotiation  
[Fri Apr 24 01:21:48 2015] [debug] ssl\_engine\_kernel.c(750): [client  
10.99.88.59] Performing full renegotiation: complete handshake protocol  
(client does support secure renegotiation)  
[Fri Apr 24 01:21:48 2015] [info] [client 10.99.88.59] Awaiting  
re-negotiation handshake  
[Fri Apr 24 01:22:18 2015] [error] [client 10.99.88.59] Re-negotiation  
handshake failed: Not accepted by client!?

This is nginx 1.6.2, OpenSSL 1.0.1m and Apache 2.2.25, OpenSSL 0.9.8y

Relevant apache config:

SSLEngine On  
SSLVerifyClient none (tried with and without this)  
SSLInsecureRenegotiation off (tried with and without this)  
SSLStrictSNIVHostCheck off (tried with and without this)  
SSLProtocol ALL -SSLv2  
SSLCipherSuite ALL:!ADH:!EXP:!LOW:!RC2:!3DES:!SEED:!RC4:+HIGH:+MEDIUM

I’ve also tried forcing a TLSv1 and a single cipher on the nginx side,  
thinking that might somehow simplify things, but no difference.

Any ideas?

Posted at Nginx Forum:

> **[Proxying to older apache fails](https://forum.nginx.org/read.php?2,258341,258341#msg-258341)**
>
> I'm trying to keep an old apache install limping along for a few more months by letting nginx handle the SSL connection between site visitors and apache. I have a pretty simple config on the nginx side for the proxy\_pass config; location / {

---

<div class="post-metadata">

**Author:** ![sporkman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/2acd7d/32.png) [@sporkman](https://www.ruby-forum.com/u/sporkman)\
**Post date:** [April 24, 2015, 1:46pm UTC](https://www.ruby-forum.com/t/proxying-to-older-apache-fails/241700/2 "2015-04-24T13:46:47Z")

</div>

Hello!

On Fri, Apr 24, 2015 at 01:27:43AM -0400, sporkman wrote:

> ```
> proxy_send_timeout 360;
> 
> ```
> 
> [Fri Apr 24 01:21:48 2015] [info] [client 10.99.88.59] Requesting connection
> 
> thinking that might somehow simplify things, but no difference.
> 
> Any ideas?

You have to configure Apache in a way which won’t force  
renegotiation. In particular, avoid configuring ciphers in  
virtual hosts - note “Reconfigured cipher suite will force  
renegotiation” in Apache logs.

–  
Maxim D.

> **[nginx](http://nginx.org/)**

---

<div class="post-metadata">

**Author:** ![sporkman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/2acd7d/32.png) [@sporkman](https://www.ruby-forum.com/u/sporkman)\
**Post date:** [April 24, 2015, 7:09pm UTC](https://www.ruby-forum.com/t/proxying-to-older-apache-fails/241700/3 "2015-04-24T19:09:55Z")

</div>

## Maxim D. Wrote:

> config;
> 
> > I see the request hit the apache side, and with some debugging  
> > re-negotiation  
> > This is nginx 1.6.2, OpenSSL 1.0.1m and Apache 2.2.25, OpenSSL  
> > ALL:!ADH:!EXP:!LOW:!RC2:!3DES:!SEED:!RC4:+HIGH:+MEDIUM  
> > renegotiation" in Apache logs.  
> > That was too simple. 🙂 Thanks so much.

I kept finding this thread and thinking a much more complicated issue  
was  
going on:

[http://forum.nginx.org/read.php?2,248982,248982](http://forum.nginx.org/read.php?2,248982,248982)

I removed all overrides and nginx and apache are happily talking ssl to  
each  
other.

Thanks again,

Charles

> –  
> Maxim D.  
> [http://nginx.org/](http://nginx.org/)
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx)

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,258341,258365#msg-258365](http://forum.nginx.org/read.php?2,258341,258365#msg-258365)