# TEMPLATE file only

Listen 443
Listen 444

SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES

SSLHonorCipherOrder on 

SSLProtocol all -SSLv3

#SSLPassPhraseDialog  file, XAMPP only. Give 'chmod 777 passphrase-file.conf' in Linux
SSLPassPhraseDialog  exec:<Path to passphrase dialog file>/passphrase-file.conf
#SSLPassPhraseDialog  builtin

SSLSessionCache        "shmcb:<Path to log dir>/logs/ssl_scache(512000)"
SSLSessionCacheTimeout  300


# Mutual TLS Virtual Host

<VirtualHost _default_:443>

DocumentRoot "<Path to log dir>/htdocs"
ServerName www.example.com:443
ServerAdmin admin@example.com
ErrorLog "<Path to log dir>/logs/error.log"
TransferLog "<Path to log dir>/logs/access.log"

SSLEngine on
# Proxy server's certificate file
SSLCertificateFile "<Path to keys>/proxy.cer"
# Proxy server's private key file
SSLCertificateKeyFile "<Path to keys>/proxy.key"
SSLProxyEngine On
# Same as proxy server's certificate file for template or the chain file from CA
SSLCertificateChainFile "<Path to keys>/proxy.cer"
#Client's certificate file
SSLCACertificateFile "<Path to keys>/client.cer"
SSLVerifyClient On
SSLVerifyDepth 10
#Backend Server's CA file
SSLProxyCACertificateFile "<Path to keys>/server.cer"

#The following .pem file should be a combination of server's unencrypted private key and server's public certificate
SSLProxyMachineCertificateFile "<Path to keys>/proxy.pem"

SSLProxyVerify require
SSLProxyCheckPeerName off
SSLProxyCheckPeerCN off
SSLProxyCheckPeerExpire off
SSLProtocol All
SSLHonorCipherOrder On

# HSTS (optional)
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"
# Remove this if you need to use frames or iframes
Header always set X-Frame-Options DENY
# Prevent MIME based attacks
Header set X-Content-Type-Options "nosniff"

ProxyVia Off
ProxyPreserveHost On
AllowEncodedSlashes NoDecode

RequestHeader set X-Forwarded-Proto https
RequestHeader set X-Forwarded-Port 2284
<Proxy *>
  Order deny,allow
  Allow from all
</Proxy>

# Reverse proxy configuration
ProxyRequests Off

#Setting SSL_CLIENT_CERT is necessary in order to pass client certificate to the backend server via the proxy, for mtls.
RequestHeader set SSL_CLIENT_CERT "" 
<Location />
  RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
  ProxyPass https://localhost:2284/
  ProxyPassReverse https://localhost:2284/
</Location>

<FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>
<Directory "<Path to log dir>/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>

BrowserMatch "MSIE [2-5]" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

CustomLog "<Path to log dir>/logs/ssl_request.log" \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>      



#Apache reverse proxy Virtual Host over SSL

<VirtualHost _default_:444>

DocumentRoot "<Path to log dir>/htdocs"
ServerName www.example.com:444
ServerAdmin admin@example.com
ErrorLog "<Path to log dir>/logs/error.log"
TransferLog "<Path to log dir>/logs/access.log"

SSLEngine On

# Proxy server's certificate file
SSLCertificateFile "<Path to keys>/proxy.cer"
# Proxy server's private key file
SSLCertificateKeyFile "<Path to keys>/proxy.key"

SSLProxyEngine On

SSLVerifyClient off

SSLVerifyDepth 10

SSLProxyVerify none
SSLProxyCheckPeerName off
SSLProxyCheckPeerCN off
SSLProxyCheckPeerExpire off
SSLProtocol All
SSLHonorCipherOrder On

# HSTS (optional)
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"
# Remove this if you need to use frames or iframes
Header always set X-Frame-Options DENY
# Prevent MIME based attacks
Header set X-Content-Type-Options "nosniff"

ProxyVia Off
ProxyPreserveHost On
AllowEncodedSlashes NoDecode

RequestHeader set X-Forwarded-Proto https
RequestHeader set X-Forwarded-Port 1861
<Proxy *>
  Order deny,allow
  Allow from all
</Proxy>

# Reverse proxy configuration
ProxyRequests Off
<Location />
  ProxyPass https://localhost:1861/
  ProxyPassReverse https://localhost:1861/
</Location>

<FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>
<Directory "<Path to log dir>/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>

BrowserMatch "MSIE [2-5]" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

CustomLog "<Path to log dir>/logs/ssl_request.log" \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>                           
