The scenario is that we have 3 tier architecture DMZ > BEA > DB with end to end encryption the data is encrypted within DMZ > BEA > DB.

I have read that modsecurity doest deal with encrypted traffic it is positioned in Apache in a way that after mod_ssl decrypts the traffic, modsecurity analyze the un-encrypted traffic.

Now after modsecurity analyze the decrypted traffic, in three tier arch it will be passed to BEA, now will that traffic be encrypted? Like after modsecurity does its thing, will that traffic again pass through mod_ssl to encrypt and send to BEA or it will be send directly to BEA after modsecurity as unencrypted?


1 Answer 1


That depends entirely on your configuration and your wishes.

Your setup certainly could re-encrypt after analyzing with mod_security and before forwarding to your application server. You would do so by using the ProxyPassReverse and SSLProxyEngine configuration options - see this question for an example.

So that begs the question: should you use TLS between your webserver and your application server?

To answer this question you'll need to assess your network and determine if you actually trust it sufficiently to retransmit your requests in the clear.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .