Re: [mod-security-users] mod_security with proxy - HTTP or HTTPS ?

[Reindl H. <h.r...@th...>]

Am 26.04.2018 um 20:23 schrieb Edouard Guigné:
> Hello Dear Mod_security users,
> 
> I installed mod_security on a proxy web server with apache, in order to
> inspect & protect traffic to a final web serveur on my LAN.
> 
> Internet  <== HTTPS ==> [PROXY with mod_security] <<=== LAN HTTP ===> [
> WEB server]
> 
> This was the V1 configuration.
> 
> Then, I changed to V2 :
> 
> Internet  <== HTTPS ==> [PROXY with mod_security] <<=== LAN *HTTP**S*
> ===> [ WEB server]
> 
> So I wondered if with V2, mod_security is able to inspect the traffic on
> the proxy server, because the traffic is encrypted in HTTPS.
> 
> Should I better to install mod_security on the WEB server instead of the
> PROXY ?


sounds like you don't understand https

it's *transport layer* and so mod_security don't need to know anything
about https at all