# Ssl between apache proxy and mongrel

**URL:** <https://www.ruby-forum.com/t/ssl-between-apache-proxy-and-mongrel/88996>\
**Category:** Deployment\
**Created:** [March 16, 2007, 10:45am UTC](https://www.ruby-forum.com/t/ssl-between-apache-proxy-and-mongrel/88996 "2007-03-16T10:45:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jz176](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jz176](https://www.ruby-forum.com/u/jz176)\
**Post date:** [March 16, 2007, 10:45am UTC](https://www.ruby-forum.com/t/ssl-between-apache-proxy-and-mongrel/88996/1 "2007-03-16T10:45:47Z")

</div>

could anybody tell me if ssl traffic proxied from apache to mongrel  
remains encrypted and is decrypted by mongrel or is it -as i would  
think- decrypted by apache and sent over the network to mongrel in plain  
text

---

<div class="post-metadata">

**Author:** ![jz176](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jz176](https://www.ruby-forum.com/u/jz176)\
**Post date:** [March 16, 2007, 1:42pm UTC](https://www.ruby-forum.com/t/ssl-between-apache-proxy-and-mongrel/88996/2 "2007-03-16T13:42:12Z")

</div>

It’s sent in plain text, but you could set up an encrypted tunnel  
between the apache box and the mongrel one using ssh or stunnel over a  
tcp port and point the apache config to localhost:chosenport.

Shawn Balestracci

---

<div class="post-metadata">

**Author:** ![jz176](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jz176](https://www.ruby-forum.com/u/jz176)\
**Post date:** [March 16, 2007, 3:54pm UTC](https://www.ruby-forum.com/t/ssl-between-apache-proxy-and-mongrel/88996/3 "2007-03-16T15:54:39Z")

</div>

On Fri, 16 Mar 2007 07:41:44 -0500  
“Vegan Buddy” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> It’s sent in plain text, but you could set up an encrypted tunnel  
> between the apache box and the mongrel one using ssh or stunnel over a  
> tcp port and point the apache config to localhost:chosenport.

I recommend stunnel too. It’s pretty easy to setup, runs as a daemon,  
and you can also (if you need) configure client certificate  
requirements so that the channel is secured on both ends.

–  
Zed A. Shaw, MUDCRAP-CE Master Black Belt Sifu

> **[Zed A. shaw](https://zedshaw.com/)**
>
> Personal essays and writings by Zed A. Shaw.

[http://www.awprofessional.com/title/0321483502](http://www.awprofessional.com/title/0321483502) – The Mongrel Book  
[http://mongrel.rubyforge.org/](http://mongrel.rubyforge.org/)

---

<div class="post-metadata">

**Author:** ![jz176](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jz176](https://www.ruby-forum.com/u/jz176)\
**Post date:** [March 16, 2007, 5:39pm UTC](https://www.ruby-forum.com/t/ssl-between-apache-proxy-and-mongrel/88996/4 "2007-03-16T17:39:06Z")

</div>

thanks for the replies guys. stunnel is exactly what i was thinking.  
i’ve used it quite a bit encrypting traffic between snort sensors and  
the management server. i just wanted to make sure i wasn’t doubling up  
on the encryption (ssl inside stunnel) and adding excess overhead.  
normally i would just take a quick packet capture and see if it was  
coming through plain text but im only doing the planning right now so i  
don’t have anything set up yet to test.

thanks again.