Question: My JBoss app server has mutual SSL authentication setup (We do some processing based on the client certificate).

I need to have a web server in front of JBoss. Which is the best apache module that can do an SSL passthrough to JBoss?

Answer: 
Unless you're after something incredibly trivial (forwarding all SSL traffic directly to JBoss without any handling by Apache at all, in which case you might as well use a TCP forwarder like rinetd), whatever it is you're trying to do is not possible.

In order for Apache to do *anything* with the SSL connection, it must negotiate the symmetric key with the client. Once Apache has done this, JBoss will not be able to decrypt the connection if apache "just" forwarded the resulting stream to JBoss. Normally, you'd forward the decrypted connection to the application. You might even be able to get apache to establish a new SSL connection from Apache to JBoss, but without the client's certificate, it would not have the authentication information JBoss is looking for.

Things to consider: could you make JBoss read the connection headers of a non-ssl connection to get this client information? Then you could [use mod\_rewrite to capture the information from the client certificate](http://mail-archives.apache.org/mod_mbox/httpd-users/200506.mbox/%3C529e02882227c3dcb217b7b1b41c0715@alum.dartmouth.org%3E). ([List of available variables](http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#envvars)) ([actual (if old) example of combining mod\_rewrite,mod\_headers,and mod\_proxy to pull this off](http://old.nabble.com/SSL-headers-through-proxy-td428156.html))

If the issue is that you want to serve some content through a webserver rather than through JBoss, consider setting up a separate host, like <https://static.example.com>.
While it is not possible to decrypt traffic on webserver without breaking client-certificate auth it might be possible to pass-through it.

The only thing that would be visible to webserver is SNI in client hello message - which usually contains domain name of a request. You could differentiate traffic based on SNI and handle it differently. Anything else will be encrypted (including URL)

Example for HA-proxy took from: <https://www.me2digital.com/blog/2019/05/haproxy-sni-routing/>

```
frontend public_ssl
    bind :::443 v4v6 
    option tcplog
    tcp-request inspect-delay 5s
    tcp-request content capture req.ssl_sni len 25
    tcp-request content accept if { req.ssl_hello_type 1 }
    # https://www.haproxy.com/blog/introduction-to-haproxy-maps/
    use_backend %[req.ssl_sni,lower,map(/usr/local/etc/haproxy/tcp-domain2backend-map.txt)]
    default_backend be_sni

```

I'm not sure if Apache could do it - but I would love to learn.