To proxy a public Apache URL to an HTTPS application server, enable the proxy modules, turn on SSLProxyEngine, and pair ProxyPass with ProxyPassReverse. The first directive routes requests; the second keeps backend redirects pointed at the public URL.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
<VirtualHost *:443>
ServerName public.example.com
SSLEngine On
# SSLCertificateFile and SSLCertificateKeyFile belong here.
SSLProxyEngine On
ProxyPass "/app/" "https://backend.example.com/"
ProxyPassReverse "/app/" "https://backend.example.com/"
ProxyRequests Off
</VirtualHost>In this arrangement, the browser has one HTTPS connection to Apache. Apache then creates a separate HTTPS connection to the backend. The backend can remain on a private network while Apache presents a single public URL.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What Apache is doing in this setup
A reverse proxy is a gateway that looks like the ordinary web server to the client. The browser requests https://public.example.com/app/; it does not connect directly to backend.example.com.
The two TLS sessions
- The browser establishes TLS with Apache’s public
<VirtualHost *:443>. Apache presents the certificate configured forpublic.example.com. - Apache matches the
/app/path and appliesProxyPass. - Because the target begins with
https://, Apache opens a second TLS connection tobackend.example.com. - The backend response travels back through Apache, which sends the response to the browser over the original client connection.
The two encrypted hops are independent. A valid certificate for the public name does not, by itself, validate the backend connection; Apache must also be configured to make the proxy-side TLS connection.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Why SSLProxyEngine On is required
Apache’s proxy TLS support is disabled by default. A backend URL using HTTPS therefore needs SSLProxyEngine On in the relevant virtual host or server configuration. Without it, Apache can be serving HTTPS to visitors while still refusing or failing to establish the HTTPS hop to the application server.
The backend certificate and trust arrangement must be intentional. Use a backend hostname that corresponds to the certificate presented by that server, and install or configure the appropriate trust chain for your environment. Publicly issued certificates, an internal certificate authority, and other private-PKI designs have different trust requirements; there is no single verification policy that fits every deployment. Do not solve a handshake problem by casually disabling certificate verification.
Prerequisites and module checklist
Load the proxy and TLS functionality before troubleshooting directives:
mod_proxyprovides the core proxy engine.mod_proxy_httphandles HTTP traffic to an HTTP or HTTPS web backend.mod_sslsupplies Apache’s TLS support, including the proxy-side SSL features.
Module names and loading mechanisms vary by operating system package. Confirm that the modules are enabled in the Apache installation used by the virtual host, then validate the configuration before reloading the service.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Configure the public HTTPS virtual host
1. Terminate client HTTPS at Apache
Place the mapping in the virtual host that owns the public hostname. The public listener must already have normal server-side TLS configured:
<VirtualHost *:443>
ServerName public.example.com
SSLEngine On
SSLCertificateFile /path/to/public certificate
SSLCertificateKeyFile /path/to/private key
SSLProxyEngine On
ProxyPass "/app/" "https://backend.example.com/"
ProxyPassReverse "/app/" "https://backend.example.com/"
ProxyRequests Off
</VirtualHost>The certificate paths above are illustrative locations; use the paths managed by your operating system or certificate process. The important distinction is that these files authenticate Apache to visitors, while the backend certificate is checked during Apache’s outgoing TLS connection.
2. Map the public path with ProxyPass
ProxyPass takes a local path and a remote URL. In the example, a request beginning with /app/ is sent to the HTTPS backend. Apache becomes the gateway for that path rather than serving the content from its local document root.
Keep the path prefix and trailing slashes deliberate. A mapping from /app/ to a backend root ending in / expresses a clean prefix-to-prefix relationship. Changing one side can alter how the remainder of the request path is joined, so test both /app/ and deeper paths such as /app/login after every change.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
3. Add the matching ProxyPassReverse
Use the same public and backend prefixes in ProxyPassReverse. This directive adjusts redirect-related response headers generated by the backend so that clients continue using the public address. It is normally needed whenever the application can issue redirects.
4. Reload only after a syntax check
- Run your platform’s Apache configuration test, commonly
apachectl configtestor an equivalent service-specific command. - Fix every syntax or module error reported by the test.
- Reload Apache using the service manager for your operating system.
- Make a request to the public URL and inspect both the response headers and the Apache error log.
ProxyPass versus ProxyPassReverse
| Directive | Direction | What it changes | What it does not change |
|---|---|---|---|
ProxyPass |
Client request to backend | Routes a local Apache path to a remote URL, including an https:// target |
It does not by itself rewrite redirect headers returned by the application |
ProxyPassReverse |
Backend response to client | Rewrites the Location, Content-Location, and URI response headers |
It does not rewrite absolute links embedded in an HTML response body |
They solve opposite halves of the same URL problem. ProxyPass makes the request reach the application; ProxyPassReverse prevents a backend redirect from exposing its private hostname or internal path to the browser.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Redirects, absolute links, and URL leakage
When ProxyPassReverse fixes the problem
Suppose the application responds to a public request with a redirect whose Location header points to https://backend.example.com/login. With the matching reverse mapping, Apache can change that header to the public path, keeping the browser on https://public.example.com/app/.... This is the main reason a reverse proxy configuration commonly contains both directives.
When it cannot help
Redirect-header rewriting does not inspect or edit the HTML body. A page containing absolute links, script URLs, form actions, or stylesheet references that point to the backend hostname can still send the browser to that private or unintended address. Correct those URLs in the application whenever possible. If application changes are not feasible, use a body-rewriting solution such as mod_proxy_html, with careful testing because rewriting can affect scripts, APIs, and cached content.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Applications that generate their own canonical URLs may also need an external base URL, trusted proxy setting, or equivalent configuration. Apache can route the request correctly, but it cannot infer every application-level URL decision.
Security settings that matter
Keep forward proxying disabled
Set ProxyRequests Off for a normal reverse-proxy deployment. Reverse proxying sends selected public paths to known backends. Forward proxying lets clients ask Apache to fetch arbitrary destinations. If that mode is enabled without strict access control, the server can become an open proxy, allowing abuse and obscuring other users’ traffic.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Limit backend exposure
A reverse proxy allows the application server to stay behind a firewall and accept traffic only from Apache or an internal network. Restrict the backend listener accordingly, while allowing the DNS name and port Apache actually uses. This reduces the number of systems that can reach the application directly and makes the public URL the controlled entry point.
Make certificate trust explicit
For the proxy-side TLS connection, decide which certificate authorities and names are trusted, and maintain that policy as certificates rotate. A certificate that is valid for a different backend name, an incomplete chain, or an untrusted private issuer can all cause the TLS handshake to fail. The correct remedy is to align names and trust material, not to assume that client-side TLS settings cover the backend hop.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Testing the mapping from the outside in
- Check the public endpoint. Request
https://public.example.com/app/with a browser or a command such ascurl -I. Confirm that Apache presents the public certificate and returns an application response or an expected redirect. - Check the backend independently. From the Apache host, test the backend hostname and port using the same protocol configured in
ProxyPass. A backend that is unreachable from Apache cannot work through the proxy. - Inspect redirect headers. Look for
Location,Content-Location, andURI. They should use the public hostname and path when the application redirects. - Inspect the page source and network requests. If images, scripts, or forms still request the backend hostname, the issue is an HTML or application URL, not a missing
ProxyPassReverse. - Read the error log during one request. It can distinguish a missing module, a connection refusal, a DNS failure, and a TLS verification or handshake problem.
Common failures and targeted fixes
Apache reports that the HTTPS backend cannot be reached
Verify that mod_proxy, mod_proxy_http, and mod_ssl are loaded, that SSLProxyEngine On is in the active virtual host, and that the backend name resolves from the Apache machine. Check firewall rules and the backend listening port before changing application settings.
The browser receives a redirect to the backend hostname
Ensure ProxyPassReverse uses the same public prefix and backend URL as ProxyPass. Then inspect the response: if the hostname appears in an HTML link rather than a redirect header, reverse-header rewriting is working as designed and the application or an HTML rewriting layer must be adjusted.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesOnly some paths fail or contain duplicated segments
Review the trailing slash and prefix on both directives. Test the root of the mapped path and a nested resource. A mismatch can produce an unexpected joined path even though the TLS and proxy modules are functioning.
The backend works directly but returns a TLS error through Apache
Test the backend certificate from the Apache host, not only from a workstation. Confirm that the certificate name matches the hostname in the https:// URL and that Apache trusts the issuing chain required by your deployment.
One backend or a balancer?
A single ProxyPass mapping is the clearest choice when one application endpoint owns a path. Apache can also proxy clusters, balance requests, cache responses, and combine several services into one URL space. The decision changes operational behavior:
| Concern | Single backend mapping | Balancer or cluster |
|---|---|---|
| Routing scope | One public prefix maps to one backend URL | One public prefix can be distributed across multiple backend members |
| Failure handling | A backend outage affects the mapped service until it recovers | Member health and failover behavior become part of the proxy design |
| Proxy-side TLS | Apache must establish and trust the HTTPS connection to that backend | Those TLS name and trust decisions apply to each HTTPS member |
| Redirect behavior | Use a matching ProxyPassReverse mapping for the backend URL |
Keep reverse mappings and application-generated URLs consistent across members |
| HTML URL rewriting | Still required if the application emits absolute internal links | Still required; balancing does not rewrite HTML bodies |
Balancing adds availability and capacity options, but it does not remove the need for correct TLS trust, redirect handling, or application URL configuration.
Quick Recap
Practical configuration checklist
- The public request lands in the intended HTTPS virtual host.
mod_proxy,mod_proxy_http, andmod_sslare enabled.SSLProxyEngine Onis present for an HTTPS backend.- The backend hostname, certificate name, port, and trust chain agree.
ProxyPassmaps the intended public prefix to the intended backend URL.ProxyPassReverseuses the corresponding pair of prefixes.- Trailing slashes have been tested at the prefix root and on nested paths.
ProxyRequests Offremains enabled unless a deliberately controlled forward proxy is required.- Redirect headers and HTML-generated absolute URLs have been tested from the public address.
- The backend firewall permits Apache while blocking unintended direct access.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
