What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To proxy an HTTPS backend through Apache, enable mod_proxy, mod_proxy_http, and mod_ssl, turn on SSLProxyEngine, then pair ProxyPass with ProxyPassReverse in the public virtual host. Apache terminates the browser’s TLS connection and creates a separate TLS connection to the backend.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What Apache is doing in this arrangement
A reverse proxy is a gateway that appears to the browser as the web server. The browser requests a public URL such as https://public.example.com/app/; it never needs to know that the application is running at https://backend.example.com/. Apache receives the public request, sends a new request to the backend, and returns the backend response to the browser.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
ProxyPass defines that routing relationship. Its first argument is the path Apache exposes locally, and its second argument is the remote URL. Because the remote URL can use https://, the backend hop can be encrypted independently of the browser-to-Apache hop.
This separation is useful when the application server must remain behind a firewall, when several services need to share one public hostname, or when you later add balancing or caching at the gateway. The backend can be private as long as Apache can resolve and reach its hostname and port.
Why an HTTPS backend needs SSLProxyEngine
Client-side TLS and proxy-side TLS are two different sessions. SSLEngine On protects the connection from the browser to Apache. It does not automatically enable TLS when Apache connects onward to an HTTPS origin. Apache’s proxy TLS support is disabled by default, so an HTTPS target requires SSLProxyEngine On.
Without that directive, Apache commonly fails the proxy request with a 500-level response and an SSL-proxy error in the error log. Turning it on enables the TLS handshake for the outbound connection; it does not by itself decide whether every backend certificate should be trusted. The certificate name, trust store, and verification policy still need to match your deployment.
Modules and prerequisites
mod_proxyprovides the proxy framework.mod_proxy_httphandles HTTP requests sent through the proxy. Load the protocol-specific module that matches the backend protocol you use.mod_sslprovides Apache’s TLS support, including theSSLProxy*directives.- The public virtual host needs a certificate and private key when it listens on HTTPS.
- Apache must be able to resolve
backend.example.comand establish a network connection to its HTTPS port.
Keep the backend hostname consistent with the name covered by its certificate. If the service uses an internal certificate authority, install and trust that authority according to your organization’s policy rather than disabling verification indiscriminately. There is no single safe private-PKI setting for every environment.
Rank #2
- Used Book in Good Condition
Minimal working configuration
Place the mapping in the HTTPS virtual host that owns the public name:
<VirtualHost *:443>
ServerName public.example.com
SSLEngine On
# SSLCertificateFile and SSLCertificateKeyFile belong here.
SSLProxyEngine On
ProxyPass "/app/" "https://backend.example.com/"
ProxyPassReverse "/app/" "https://backend.example.com/"
ProxyRequests Off
</VirtualHost>The public path is /app/; the backend path in this example is its root, /. A request for /app/orders is sent to the corresponding backend URL under that mapping. Choose the path deliberately: changing either side changes what the application sees.
After editing the configuration, run your platform’s Apache syntax check (for example, apachectl configtest) before reloading. A successful syntax check does not prove that DNS, firewall rules, TLS trust, or application redirects are correct, so test an actual request through the public hostname as well.
How a request travels through both TLS hops
- The browser resolves
public.example.comand opens a TLS session to Apache. - Apache selects the matching
VirtualHostand terminates that client-side TLS session. - The request path is matched against
ProxyPass "/app/". - Apache opens a separate TLS connection to
backend.example.com, enabled bySSLProxyEngine On. - The backend processes the request and sends a response to Apache.
- Apache applies reverse-proxy response-header adjustments, then returns the response over the browser’s original connection.
The browser therefore sees one public origin, while the backend sees Apache as its network client. Logging and access-control decisions should account for that distinction; preserve forwarded client information only when your application and network policy require it.
ProxyPass versus ProxyPassReverse
| Directive | Direction | Purpose | What it does not do |
|---|---|---|---|
ProxyPass |
Client request to backend | Maps a public Apache path to a remote URL and sends matching requests there. | It does not rewrite links or redirect headers returned by the application. |
ProxyPassReverse |
Backend response to client | Adjusts Location, Content-Location, and URI response headers so redirects can remain on the public URL. |
It does not rewrite absolute URLs embedded in HTML, JavaScript, CSS, or API payloads. |
Use the same public and backend prefixes in both directives unless you have a specific, tested reason to diverge. The reverse mapping is especially important when the application redirects to its own hostname or to a path that exists only on the backend.
Keeping redirects on the public hostname
Suppose a client requests https://public.example.com/app/login and the backend replies with a Location: https://backend.example.com/login header. With the matching ProxyPassReverse rule, Apache adjusts that redirect before sending it to the browser, preventing the client from being sent directly to the private or unexpected hostname.
This adjustment applies to response headers, not response bodies. If the HTML contains https://backend.example.com/assets/app.css, the browser can still request that backend URL directly. Fix those links in the application’s public-base-URL setting where possible. If application changes are not available, investigate Apache’s mod_proxy_html for carefully scoped HTML rewriting; it is a separate feature and must be tested against scripts, forms, and compressed responses.
Trailing slashes and path prefixes
Slash placement controls how Apache joins the incoming and destination paths. In the example, both mappings end their public prefix with /, while the backend target is the root. Keep that choice consistent and test representative URLs such as:
/app/(the directory root)/app/index.html(a file below the prefix)/app/api/v1/items(a nested route)/application(a near-match that should not accidentally be treated as/app/)
Applications that generate redirects or absolute paths often assume they are mounted at /. If you mount one below /app/, configure its base path or URL prefix explicitly; otherwise, login callbacks, static files, and API links may point to the wrong location even though the proxy itself is functioning.
ProxyRequests Off and reverse-proxy security
Set ProxyRequests Off for a normal reverse proxy. Forward proxying is a different function in which clients ask Apache to fetch arbitrary Internet destinations. Enabling it without strict access control can create an open proxy that attackers use to hide traffic or abuse your network.
- Expose only the paths you intend to proxy; do not create a broad catch-all mapping accidentally.
- Allow Apache to reach only the required backend addresses and ports through firewall rules.
- Keep backend certificate verification aligned with your trust policy; do not treat
SSLProxyEngine Onas a substitute for certificate validation. - Review Apache access and error logs for failed handshakes, unexpected hostnames, redirect loops, and requests outside the intended prefix.
- Make sure the backend does not generate public links or cookies for a hostname that clients cannot reach.
Troubleshooting by symptom
| Symptom | Likely cause | Checks and fixes |
|---|---|---|
| Apache returns a 500 error and the log mentions proxy SSL | Outbound proxy TLS is disabled or the handshake cannot be completed. | Confirm SSLProxyEngine On is in the active virtual host, verify mod_ssl is loaded, and inspect certificate, hostname, protocol, and trust errors in the error log. |
| Apache cannot connect to the backend | DNS, routing, firewall, port, or service failure. | Resolve the backend name from the Apache host, check network reachability to its HTTPS port, and test the backend independently from the same network segment. |
| The browser is redirected to the backend hostname | ProxyPassReverse is missing, mismatched, or the application emits a body link rather than a redirect header. |
Compare both mapping prefixes, inspect the response’s Location header, and distinguish header rewriting from HTML or JavaScript URL rewriting. |
Static files or API calls return 404 under /app/ |
The backend assumes root mounting or the path join is wrong. | Check the exact public-to-backend path mapping, trailing slashes, and the application’s external base URL. |
| A redirect loop occurs between HTTP and HTTPS | The backend does not know the original client scheme, or Apache has separate HTTP and HTTPS rules that conflict. | Inspect the application’s scheme detection and forwarded-request settings, then ensure the canonical HTTPS redirect is applied at one deliberate layer. |
| Some pages work but links expose an internal URL | Absolute URLs are embedded in the response body. | Prefer application URL configuration; use body rewriting only as a controlled fallback and test every content type it touches. |
One backend or a balancer?
A single ProxyPass target is the simplest choice when one application endpoint owns the path. Apache’s reverse-proxy features can also front a cluster, distribute requests, cache responses, and combine multiple services under one URL space. The operational trade-offs are different:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems| Decision point | Single backend mapping | Balancer or clustered setup |
|---|---|---|
| Routing scope | One public prefix maps to one origin. | One prefix can be served by multiple members or several coordinated services. |
| Failure handling | A backend outage makes that mapped service unavailable until it recovers. | Members can provide capacity or failover, subject to health and session requirements. |
| TLS trust | Apache needs a working TLS and trust relationship with the one configured origin. | That relationship must be valid for every backend member or for the names used to reach them. |
| Redirect behavior | One application’s public URL and redirect policy are easy to reason about. | Every member must generate compatible public redirects and external URLs. |
| HTML or application rewriting | Still required if the application emits backend URLs in response bodies. | Still required; balancing does not rewrite HTML or fix an incorrect external base URL. |
Start with one correctly tested mapping. Add balancing only when availability or capacity requires it, and then document health checks, session persistence, member certificates, and how each application constructs public URLs.
Deployment checklist
- The public DNS name points to the Apache host.
- The HTTPS virtual host has its server certificate and key configured.
mod_proxy, the HTTP proxy protocol module, andmod_sslare loaded.SSLProxyEngine Onappears in the virtual host that performs the HTTPS proxying.- The backend hostname resolves from Apache and its certificate covers the name Apache uses.
ProxyPassandProxyPassReverseuse intentional, tested path prefixes.ProxyRequests Offremains enabled unless you are deliberately operating a restricted forward proxy.- Apache configuration passes its syntax check before reload.
- Tests cover normal pages, redirects, authentication, static assets, APIs, trailing-slash variants, and failure logging.
Bottom line
An HTTPS reverse proxy needs two pieces that are easy to confuse: ProxyPass sends public requests to the backend, while SSLProxyEngine On enables TLS for that outbound hop. Pair the route with ProxyPassReverse so backend redirect headers stay on the public URL, keep forward proxying disabled, and treat HTML links, certificate trust, and path prefixes as separate configuration concerns.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
