开发者

How can I setup a https reverse proxy to several nodejs-https-servers on the same machine (many domains and certificates, one VPS and IP)

开发者 https://www.devze.com 2023-03-09 14:31 出处:网络
Currently we have about 10 clients web sites and web systems on one VPS. They all share the same IP. We\'ve built our own proxy-logic in nodejs, using node-http-proxy, and it matches the domain and p

Currently we have about 10 clients web sites and web systems on one VPS. They all share the same IP.

We've built our own proxy-logic in nodejs, using node-http-proxy, and it matches the domain and passes on to either node-http-servers on different ports for different sites, or to apache if no nodejs-service is setup for a certain path. This has worked fine for quiet some time.

Now we're implementing credit c开发者_如何学Goard payment for one of the customers and need an https-connection. I recoded the proxy to handle https and it works. BUT, we don't want to user the customers certificate on the proxy. When another customers site needs https-connections we'll want that to work.

Is it possible to set up a nodejs-reverse-proxy that passes the https-request on without 'certifying' it, so that the receiving node-https-server 'certifies it'?

Or some other reverse-proxy, if it can't be done with nodejs, before ours?


So basically you'd want multiple HTTPS websites hosted under the same IP, under nodejs, right ?

If that's the case.. you might want to consider, first of all, the compatibility: (from what I know) multiple HTTPS certificates can reside on one IP ONLY IF THE CLIENT ALSO SUPPORTS SNI ( more info @ https://sni.velox.ch/, and I was referring, of course at different domains certificates, not wildcards certs for subdomains ).

The limitation raised by "traditional" HTTPS rises because of a feature: encryption starts early (earlier than sending the server what hostname you tried to access, so the traditional server - the one without SNI - doesn't know which cert to provide ). While this is secure and very widely supported among browsers, it forces you to buy/rent a new IP for each of the HTTPS hosted websites.

0

精彩评论

暂无评论...
验证码 换一张
取 消