Question: My JBoss app server has mutual SSL authentication setup (We do some processing based on the client certificate).

I need to have a web server in front of JBoss. Which is the best apache module that can do an SSL passthrough to JBoss?

Answer: 
This may be a wild goose chase, since I'm unsure of how well JBoss will handle this, but it sounds like using `SSLOptions +ExportCertData` will hand a client certificate through an AJP connection, by virtue of AJP's ability to pass environment variables.

This depends on your comfort level with having the data between the Apache and JBoss servers being unencrypted, as well as whether JBoss will recognize the cert in the passed environment variable. See [here](http://www.zeitoun.net/articles/client-certificate-x509-authentication-behind-reverse-proxy/start).
While it is not possible to decrypt traffic on webserver without breaking client-certificate auth it might be possible to pass-through it.

The only thing that would be visible to webserver is SNI in client hello message - which usually contains domain name of a request. You could differentiate traffic based on SNI and handle it differently. Anything else will be encrypted (including URL)

Example for HA-proxy took from: <https://www.me2digital.com/blog/2019/05/haproxy-sni-routing/>

```
frontend public_ssl
    bind :::443 v4v6 
    option tcplog
    tcp-request inspect-delay 5s
    tcp-request content capture req.ssl_sni len 25
    tcp-request content accept if { req.ssl_hello_type 1 }
    # https://www.haproxy.com/blog/introduction-to-haproxy-maps/
    use_backend %[req.ssl_sni,lower,map(/usr/local/etc/haproxy/tcp-domain2backend-map.txt)]
    default_backend be_sni

```

I'm not sure if Apache could do it - but I would love to learn.