title: Apache HTTPD/mod_proxy/Tomcat and SSL with client auth
body: <p>I'm sure this is an FAQ but I couldn't find anything I recognized as being the same question.</p>
  
  <p>I have several web-apps running in Tomcat, with some pages e.g. the login page protected by SSL as defined by confidentiality elements in their web.xmls. One of the apps also accepts client-authentication via certificate. I also have a rather extensive JAAS-based authorization &amp; authentication scheme, and there is all kinds of shared code and different JAAS configurations etc between the various webapps.</p>
  
  <p>I really don't want to disturb any of that while accomplishing the below.</p>
  
  <p>I am now in the process of inserting Apache HTTPD with mod-proxy and mod-proxy-balancer in front of Tomcat as a load balancer, prior to adding more Tomcat instances.</p>
  
  <p>What I want to accomplish for HTTPS requests is that they are redirected 'blind' to Tomcat without HTTPD being the SSL endpoint, i.e. HTTPD just passes ciphertext directly to Tomcat so that TC can keep doing what it is already doing with logins, SSL, web.xml confidentialty guarantees, and most importantly client authentication.</p>
  
  <p>Is this possible with the configuration I've described?</p>
  
  <p>I am very familiar with the webapps and SSL and HTTPS and Tomcat, but my knowledge of the outer reaches of Apache HTTPD is limited.</p>
  
  <p>Happy to have this moved if necessary but it is kind of programming with config files ;)</p>