Posted on by Arnon

Using your Raspberry Pi as an SSL Proxy

Not long ago, I have purchased an IP camera for my home. A nice toy I must say. I wanted to expose this camera for outside access. The issue is that this camera's interface does not support SSL.

Well because privacy is involved, the least I could do is add SSL somehow. I googled a bit and came across this article. I decided to use my raspberry pi for that.

The process itself is relatively easy but I had to do some improvisations over the article above. So I decided to make a tutorial for this.

You can use this to add SSL layer on top of every http you have.

So here we go:

  1. Install apache2 on your raspberry pi:
    sudo apt-get install apache2
  2. Enable ssl, proxy and proxy_http modules:
    sudo a2enmod ssl
sudo a2enmod proxy
sudo a2enmod proxy_http
  3. Add listener to port 10001 (You can use any port, this is from the sample)
    I have used ports.conf file to add it. You can create a new configuration file for this if you like
    NameVirtualHost *:10001

Listen 10001
  4. Add definitions for you camera's reverse proxy (VirtualHost tag)

    Few notes:

  • The camera's internal address and port in this example is 192.168.9.11:81
  • The logs are located in /var/log/apache2 - you can change it to a path you desire
  • The certificate are self signed. It is explained next
<VirtualHost *:10001>
 ProxyRequests Off
 ProxyPreserveHost On
 ProxyVia On

 Order deny,allow
 Allow from all

 ProxyPass / http://192.168.9.11:81/
 ProxyPassReverse / http://192.168.9.11:81/
 CustomLog /var/log/apache2/access_cam1.log combined
 ErrorLog /var/log/apache2/error_cam1.log
 ServerName cam1

 SSLEngine On
 SSLCertificateFile /etc/apache2/mycrt.crt
 SSLCertificateKeyFile /etc/apache2/mycrt.key

 <FilesMatch "\.(cgi|shtml|phtml|php)$">
 SSLOptions +StdEnvVars

 SSLOptions +StdEnvVars

 BrowserMatch "MSIE [2-6]" \
 nokeepalive ssl-unclean-shutdown \
 downgrade-1.0 force-response-1.0
 # MSIE 7 and newer should be able to use keepalive
 BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>

Now we need to create certificate files. I used this guide in order to do it. It's pretty straight forward (In my example above I've called them "mycrt")

We're almost good to go. In case you created a passphrase for you certificate, you will notice that as you restart your apache2 it will require you to enter your passphrase.

This can be avoided, if you'd like.

  • Create a shell script that echoes your passphrase:
    file: nopass.sh
    #!/bin/bash
 echo your-password
  • Add execute permissions to this script
  • Edit ssl.conf, and change the SSLPassPhraseDialog line
    SSLPassPhraseDialog exec:/etc/apache2/nopass.sh

That's it! Now you can restart your apahce with

sudo service apahce2 restart

Now try accessing your raspberry pi with https://<ip>:10001

You should see your webcam's login interface with SSL

Feel free to port-forward from your router to your raspberry pi's new SSL port in order to access your camera from the outer world

I hope this guide is useful for you.

Share