如何建立现成的 https 到 http 网关？
我有一个 HTTP 服务器，它位于我们的内部网络中，只能从内部网络访问。 我想放置另一台服务器来侦听可从外部访问的 HTTPS 端口，并将请求转发到该 HTTP 服务器（并通过 HTTPS 发回响应）。 我知道有几种方法可以通过涉及一些编程来做到这一点（我自己用 Tomcat 和我编写的一个非常简单的 servlet 做了一个临时解决方案），但是有没有一种方法可以做同样的事情，只需插入已经制作的部分（如 Apache + 模块）？
I have an HTTP server which is in our internal network and accessible only from inside it. I would like to put another server that would listen to an HTTPS port accessible from outside, and forward the requests to that HTTP server (and send back the responses via HTTPS). I know that there are several ways to do this with some programming involved (and I myself made a temporary solution with Tomcat and a very simple servlet I wrote), but is there a way to do the same just plugging parts already made (like Apache + modules)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这就是 stunnel 设计的用例。 有一个使用 stunnel 包装 HTTP 服务器的特定示例。
不过，您应该考虑这是否真的是一个好主意。 设计用于企业防火墙内部的 Web 应用程序的安全性通常相当宽松。 仅仅对连接进行加密可以防止随意窃听，但不能保证站点的安全。 如果攻击者找到您的外向服务器并开始连接到它，他们仍然可以尝试查找 Web 服务中可利用的缺陷（SQL 注入、跨站点脚本等）。
This is the sort of use-case that stunnel is designed for. There is a specific example of using stunnel to wrap an HTTP server.
You should consider whether this is really a good idea, though. Web applications designed for use inside a corporate firewall are often fairly lax about security. Merely encrypting the connections prevents casual eavesdropping, but does not secure the site. If an attacker finds your outward facing server and starts connecting to it, they can still try to find exploitable flaws in the web service (SQL injection, cross-site scripting, etc).
要建立现成的 HTTPS 到 HTTP 网关，您可以使用反向代理服务器，例如 NGINX 或 Apache。 这允许您将流量从 HTTPS 站点路由到 HTTP 站点。 例如，如果您想将 r2parking 的 HTTPS 站点的流量路由到 r2parking 的 HTTP 站点，您可以配置反向代理服务器侦听 HTTPS 端口 (443) 并将请求转发到 r2parkingword 域的 HTTP 端口 (80)。 这样，HTTPS 站点的访问者就能够访问 HTTP 站点
To put up an off-the-shelf HTTPS to HTTP gateway, you can use a reverse proxy server like NGINX or Apache. This allows you to route traffic from an HTTPS site to an HTTP site. For example, if you wanted to route traffic from an HTTPS site for r2parking to an HTTP site for r2parking, you could configure the reverse proxy server to listen on the HTTPS port (443) and forward requests to the HTTP port (80) for the r2parkingword domain. This way, visitors to the HTTPS site would be able to access the HTTP site
使用 Apache 查看 mod_proxy。
Apache 2.2 mod_proxy 文档
Apache 2.0 mod_proxy 文档
With Apache look into mod_proxy.
Apache 2.2 mod_proxy docs
Apache 2.0 mod_proxy docs