I'm developing a WAF with good GUI and better log. And my base firewall is mod-security. It works well for http but I also want to work my WAF with https. Any suggestions?
Terminate your SSL sessions as the very first thing you do at your reverse proxy / load balancer. Then feed the terminated sessions through your WAF, then to your regular daemon. Basically, you need to add another reverse proxy to the chain.