The main problem is the SSL handshake. The first turnkey must handle the SSL handshake before any request will be processed. So i have changed the configuration:

/etc/apache2/sites-available/default:

NameVirtualHost *:80
<VirtualHost *:80>
        ServerName www.example.com
        Redirect permanent / https://www.example.com/
</VirtualHost>
<VirtualHost *:80>
        ServerName subdomain.example.com
        Redirect permanent / https://subdomain.example.com/
</VirtualHost>

NameVirtualHost *:443
<VirtualHost *:443>
        SSLEngine on
        SSLCertificateFile /var/ssl/www.example.com.crt
        SSLCertificateKeyFile /var/ssl/www.example.com.key
        SSLCACertificateFile /var/ssl/intermediate.crt
        ServerName www.example.com
        ServerAlias example.com
        DocumentRoot /var/www/admin-interface/public
</VirtualHost>
<VirtualHost *:443>
        SSLEngine on
        SSLCertificateFile /var/ssl/subdomain.example.com.crt
        SSLCertificateKeyFile /var/ssl/subdomain.example.com.key
        SSLCACertificateFile /var/ssl/intermediate.crt
        ServerName subdomain.example.com
        ProxyPass / https://192.168.2.12:443/
        ProxyPassReverse / https://192.168.2.12:443/
</VirtualHost>

Now the SSL handshake works, but now i got an error on the page:

Bad Request
Your browser sent a request that this server could not unterstand.

The problem was a usage of mod_rewrite definition outside the <virtualhost>. I moved it inside and everything works. Here the final configuration:

/etc/apache2/mods-enabled/proxy.conf (not neccessary to enable for reverse proxy):

#ProxyRequests Off
#<Proxy *>
#    AddDefaultCharset off
#    Order deny,allow
#    Allow from all
#</Proxy>
#ProxyVia On

/etc/apache2/sites-available/default

NameVirtualHost *:80
<VirtualHost *:80>
    ServerName www.example.com
    Redirect permanent / https://www.example.com/
</VirtualHost>
<VirtualHost *:80>
    ServerName subdomain.example.com
    Redirect permanent / https://subdomain.example.com/
</VirtualHost>

NameVirtualHost *:443
<VirtualHost *:443>
    ServerName www.example.com
    ServerAlias example.com

    SSLEngine on
    SSLCertificateFile /var/ssl/www.example.com.crt
    SSLCertificateKeyFile /var/ssl/www.example.com.key
    SSLCACertificateFile /var/ssl/intermediate.crt

    DocumentRoot /var/www/admin-interface/public

    <Location />
        RewriteEngine On

        ...
    </Location>
</VirtualHost>
<VirtualHost *:443>
    ServerName subdomain.example.com

    SSLProxyEngine On
    ProxyPass / https://192.168.2.12:443/
    ProxyPassReverse / https://192.168.2.12:443/

    SSLEngine on
    SSLCertificateFile /var/ssl/subdomain.example.com.crt
    SSLCertificateKeyFile /var/ssl/subdomain.example.com.key
    SSLCACertificateFile /var/ssl/intermediate.crt
</VirtualHost>

mv /etc/etc/apache2/sites-available/default /apache2/sites-available/default.conf

Don't forget to restart Apache when you're done.

If you still have problems check the Apache log (tail /var/log/apache2/error.log) for clues on what might be causing the issue.

Hi, i now upgrade to turnkey 14.0 with apache 2.4.10. Now I've got a new error:

Proxy Error

The proxy server could not handle the request GET /.
Reason: Error during SSL Handshake with remote server

What is the difference between the configuration of apache 2.2 to apache 2.4 that causes this error?
Can everybody help?

Thanks!

So the "proper" SSL connection needs to terminate at the front end reverse proxy (not the backend server). IMO so long as the backend server is not public internet available, then the easiest is to just use plain HTTP between the proxy and the backend (so long as no one can listen in, no need to encrypt it IMO).

OTOH if your backend is connected via some hostile network (i.e. not direct private communication) or you are concerned about the possibility of someone snooping (e.g. a wifi hotspot running on the same network) then you'll need to set up an additional SSL connection between your proxy and your backend.

There are different ways to skin that cat; but it is well summarised on InfoSec StackExchange here. Personally I'd go with his first suggestion...

Hi Jeremy,

once again! Thanks for your fast response, really!

Yes, i rename it to default.conf. The error.log contains some hints:

[Sat Jul 02 06:53:53.573896 2016] [ssl:warn] [pid 3651] AH01909: 127.0.1.1:12322:0 server certificate does NOT include an ID which matches the server name
[Sat Jul 02 07:01:54.807560 2016] [proxy:error] [pid 4186] (502)Unknown error 502: AH01084: pass request body failed to 192.168.2.12:443 (192.168.2.12)
[Sat Jul 02 07:01:54.807621 2016] [proxy:error] [pid 4186] AH00898: Error during SSL Handshake with remote server returned by /
[Sat Jul 02 07:01:54.807627 2016] [proxy_http:error] [pid 4186] AH01097: pass request body failed to 192.168.2.12:443 (192.168.2.12)

The problem is the verification of the SSL certificate. The apache server don't trust my certificate? I order this from my provider (its not self signed), i dont know whats wrong with my SSL certificate?

A quick solution is to disable SSL verification by adding this lines in the SSLProxyEngine section:

SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off

But I'am not sure if this a secure solution?

FWIW, as I think I posted earlier, under the hood TurnKey is Debian (v13.x = Debian Wheezy; v14.x = Debian Jessie).

Yes, you are right. The internat traffic don't have to be encrypted. And yes, except someone is snooping our internal network.

But with the solution above the transfer is still encrypted, only the verification of the certificate is disabled. So, it should be save.

I'm just looking for a pretty solution and want to understand why the ssl verification in the apache 2.4.xx failed, but not in the apache 2.2.xx. I will just look in more apache specific groups ... i dont found a hint in the release notes.

Thanks g.g.

Hi Jeremy,

thanks a lot for your help and discussion. I will ask in an other forum and post my final results here.

g.g.

I dont find a solution for the SSL verification of the proxys. I use SSL, but i disable the verification by these lines:

 SSLProxyVerify none
 SSLProxyCheckPeerCN off
 SSLProxyCheckPeerName off
 SSLProxyCheckPeerExpire off

It works. Another way is to use not encrypted traffic between the internal server, but i dont try it.