Apache Remote proxy for a reverse proxy SNI mismatch

Having an issue with our setup of an Apache-2.2 and a reverse proxy which is proxied to via another device.

flow is: Apache A -> proxy.abc.net -> Apache B

The error we get on Apache B is

Hostname proxy.abc.net provided via SNI and hostname backend.abc.net provided via HTTP are different

Current configuration

    <VirtualHost frontend.abc.com:80>

    ServerName frontend.abc.com

    SSLEngine on
    SSLOptions +StrictRequire
    SSLProtocol -all +TLSv1
    SSLHonorCipherOrder On
    SSLCipherSuite RC4-SHA:HIGH:!ADH:!MD5
    SSLCertificateFile conf/certs/cert.cer
    SSLProxyCACertificateFile certs/proxy.cer
    SSLCertificateKeyFile conf/certs/cert.pem
    SSLCertificateChainFile conf/certs/chain.cer


    DocumentRoot /foo/bar

    SSLProxyEngine On
    ProxyRequests Off
    ProxyPreserveHost off
    ProxyErrorOverride On
    SetEnv proxy-sendchunked 1

    ProxyRemote "*"  https://proxy.abc.net:8080
    ProxyPass  /foo  https://backend.abc.net:8888/foo  disablereuse=on

</Virtual Host>

Adding

SSLProxyProtocol SSLv3

works as it doesn't do the SNI check, but SSLv3 isn't an option we are required to use TLSv1 or greater.


Apache 2.2 has this check hardcoded (compares SNI hostname and Host hostname).

Apache 2.4 relaxes this condition and fails only if:

        * The request does not select the virtual host that was
        * selected by the SNI and its SSL parameters are different

https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/modules/ssl/ssl_engine_kernel.c?view=annotate#l335

so the answer is to upgrade to 2.4.