Running proxy in front of an Apache2 web server about esni-rev-proxy HOT 2 CLOSED

Hey, @dhruvrauthan,

AFAIU, the situation is this:

1. By default esni-rev-proxy is listening on 0.0.0.0:443, so you either instruct proxy with -b flag to listen on different port or reconfigure apache server to listen to a different port.
2. Since esni-rev-proxy is intended to run as a front end it is better to stick to 443 standard port on it, but of course it is up to you.

Anyway, in order to simplify testing, follow this:

1. Leave you apache config as it is
2. Start esni proxy with:
   -b 0.0.0.0:8443 (any arbitrary port that is not occupied)
   -upstream https://localhost (this is an endpoint of your apache server if you run on the same machine, and your apache is listening on all interfaces)

Then try to curl your esni-rev-proxy, and you should be redirected to your apache.
curl https://localhost:8443 -k
But be aware, your curl requests to ensi rev proxy are not ESNI encrypted, since proxy can handle plain TLS 1.2,1.3 and so on just for the sake of support plain versions.

In order to get true ESNI TLS handshake you need your client application (i.e. browser) to support ESNI - in order to setup client infrastructure you need to follow this steps:

• have a look on How to run: section in readme.
• study this explanation https://habr.com/ru/company/exness/blog/506452/ (this is my article in Russian) and this is translationby google translate https://translate.google.com/translate?sl=ru&tl=en&u=https://habr.com/ru/company/exness/blog/506452/

For the sake of local testing you can use esnitool (have a look on readme how to build it).

from esni-rev-proxy.

@i-prudnikov Thank you so much for helping out

Finally, I commented out the Listen 443 line in the ports.conf in the Apache2 files, and further made changes to the VirtualHost conf file to <VirtualHost *:8080>. So Apache2 wasn't listening on the 443 port and the reverse proxy could work on it.

The output is as expected, whenever I visit my website, I cannot identify the server_name extension in the ClientHello since it is encrypted.

Once again, thank you very much

from esni-rev-proxy.