{"id":995,"date":"2021-12-16T17:23:33","date_gmt":"2021-12-16T15:23:33","guid":{"rendered":"https:\/\/plumrocket.com\/learn\/?p=995"},"modified":"2025-04-03T14:45:48","modified_gmt":"2025-04-03T11:45:48","slug":"how-to-configure-varnish-cache-with-apache-reverse-proxy-and-ssl-termination","status":"publish","type":"post","link":"https:\/\/plumrocket.com\/learn\/ssl-varnish-apache","title":{"rendered":"How To Configure Varnish Cache with Apache Reverse Proxy and SSL Termination"},"content":{"rendered":"\n

In this guide, we will show you how to install and configure the Varnish cache for the Apache webserver with SSL termination. One limitation of Varnish Cache is that it is designed to accelerate HTTP, not the secure HTTPS protocol. Therefore, some workarounds must be performed to allow Varnish to work on SSL enabled website. <\/p>\n\n\n\n

SSL\/TLS Termination is the process of decrypting SSL-encrypted traffic. In our case, Apache acts like a proxy server and intermediary point between the client and Varnish and is used to convert HTTPS to HTTP. <\/p>\n\n\n\n

\"Apache<\/figure><\/div>\n\n\n\n
\n

Getting Varnish installed is just the beginning. Unlock significant performance gains for your store with our dedicated Magento Speed Optimization service<\/span><\/a>, including expert VCL tuning. <\/p>\n<\/div><\/div>\n\n\n\n

Step 1. Install and Configure Apache (Backend) on CentOS\/RHEL 8<\/h2>\n\n\n\n

We had CentOS 8 installed on our web server, which uses dnf<\/code> package manager. However, if you are familiar with Linux systems, you can apply this manual almost entirely to other OS, such as Centos 7 (use yum<\/code>) or Ubuntu and Debian (use apt<\/code> instead).<\/p>\n\n\n\n

1. Install Apache, start it automatically at boot, and launch<\/h3>\n\n\n\n
<\/div>
sudo dnf install httpd\nsudo systemctl enable httpd\nsudo systemctl start httpd\nsudo systemctl status httpd<\/code><\/pre><\/div>\n\n\n\n
2. Create a directory for your website and grant permissions<\/h3>\n\n\n\n
Make sure to replace the \u201cexample.com\u201d with your domain name:<\/p>\n\n\n\n
<\/div>
sudo mkdir -p \/var\/www\/example.com\/public_html\nsudo mkdir -p \/var\/www\/example.com\/log\nsudo mkdir -p \/var\/www\/example.com\/ssl<\/code><\/pre><\/div>\n\n\n\n
Use aux | grep httpd<\/code> or ps aux | grep apache<\/code> to see what user Apache is using on your system.<\/p>\n\n\n\n
In our case, the Apache user is \u201capache\u201d (you may see \u201cwww-data\u201d or other username displayed), therefore we will run the following commands to grant necessary permissions:<\/p>\n\n\n\n
<\/div>
sudo chown -R apache:apache \/var\/www\/\nsudo chmod -R 750 \/var\/www<\/code><\/pre><\/div>\n\n\n\n
3. Create a dummy index file in your domain\u2019s document root directory<\/h3>\n\n\n\n
<\/div>
echo 'Hello, World!' > \/var\/www\/example.com\/public_html\/index.html<\/code><\/pre><\/div>\n\n\n\n
4. Create a new virtual host file and restart Apache<\/h3>\n\n\n\n
<\/div>
sudo mkdir \/etc\/httpd\/sites-available\nsudo mkdir \/etc\/httpd\/sites-enabled<\/code><\/pre><\/div>\n\n\n\n
Tell Apache to look for virtual hosts in the sites-enabled<\/strong> directory:<\/p>\n\n\n\n
<\/div>
sudo vi \/etc\/httpd\/conf\/httpd.conf<\/code><\/pre><\/div>\n\n\n\n
Add this line at the end of httpd.conf<\/strong> file: <\/p>\n\n\n\n
IncludeOptional sites-enabled\/*.conf<\/code><\/p>\n\n\n\n
Create the new virtual host file: <\/p>\n\n\n\n
<\/div>
sudo vi \/etc\/httpd\/sites-available\/example.com.conf<\/code><\/pre><\/div>\n\n\n\n
<\/div>
<VirtualHost *:80>\n    ServerName example.com\n    ServerAlias www.example.com\n    DocumentRoot \/var\/www\/example.com\/public_html\n    ErrorLog \/var\/www\/example.com\/error.log\n    CustomLog \/var\/www\/example.com\/requests.log combined\n<\/VirtualHost><\/code><\/pre><\/div>\n\n\n\n
Enable the new virtual host files<\/p>\n\n\n\n
<\/div>
sudo ln -s \/etc\/httpd\/sites-available\/example.com.conf \/etc\/httpd\/sites-enabled\/example.com.conf<\/code><\/pre><\/div>\n\n\n\n
Restart Apache<\/p>\n\n\n\n
<\/div>
sudo systemctl restart httpd<\/code><\/pre><\/div>\n\n\n\n
Open access to the HTTP service in the firewall<\/p>\n\n\n\n
<\/div>
systemctl restart firewalld\nsystemctl enable firewalld.service\nfirewall-cmd --state\nfirewall-cmd --zone=public --permanent --add-service=http\nfirewall-cmd --reload<\/code><\/pre><\/div>\n\n\n\n
Open your domain in the web browser to see the \u201cHello, World!\u201d message, e.g.:<\/p>\n\n\n\n
http:\/\/example.com<\/a> or http:\/\/example.com:80<\/a><\/p>\n\n\n\n
\"Apache
Step 1. Diagram<\/figcaption><\/figure><\/div>\n\n\n\n
Step 2. Install and Configure Varnish Cache<\/h2>\n\n\n\n
1. Install Varnish Cache<\/h3>\n\n\n\n
<\/div>
dnf module install varnish<\/code><\/pre><\/div>\n\n\n\n
Change the default Varnish Listen port from 6081 to 80.<\/p>\n\n\n\n
<\/div>
sudo vi \/etc\/systemd\/system\/varnish.service<\/code><\/pre><\/div>\n\n\n\n
Find the following line: <\/p>\n\n\n\n
ExecStart=\/usr\/sbin\/varnishd -a :<strong><em>6081<\/em><\/strong> -f \/etc\/varnish\/default.vcl -s malloc,256m<\/code><\/p>\n\n\n\n
And replace it with this one:<\/p>\n\n\n\n
ExecStart=\/usr\/sbin\/varnishd -a :<strong><em>80 <\/em><\/strong>-f \/etc\/varnish\/default.vcl -s malloc,256m<\/code><\/p>\n\n\n\n
Save changes.<\/p>\n\n\n\n
Check the default Varnish backend IP and port.<\/p>\n\n\n\n
<\/div>
sudo vi \/etc\/varnish\/default.vcl<\/code><\/pre><\/div>\n\n\n\n
It should look like this:<\/p>\n\n\n\n
<\/div>
backend default {\n    .host = \"127.0.0.1\";\n    .port = \"8080\";\n}<\/code><\/pre><\/div>\n\n\n\n
2. Change the default apache HTTP port 80 to 8080 (or any other port of your choice)<\/h3>\n\n\n\n
<\/div>
sudo vi \/etc\/httpd\/conf\/httpd.conf<\/code><\/pre><\/div>\n\n\n\n
Find the following line: <\/p>\n\n\n\n
Listen <strong><em>80<\/em><\/strong><\/code><\/p>\n\n\n\n
And replace it with this one:<\/p>\n\n\n\n
Listen <strong>8080<\/strong><\/code><\/p>\n\n\n\n
Save changes.<\/p>\n\n\n\n
Open your virtual host file: <\/p>\n\n\n\n
<\/div>
sudo vi \/etc\/httpd\/sites-available\/example.com.conf<\/code><\/pre><\/div>\n\n\n\n
Find the following line: <\/p>\n\n\n\n
<VirtualHost <strong><em>*:80<\/em><\/strong>><\/code>
    ServerName example.com<\/code><\/p>\n\n\n\n
And replace it with this one:<\/p>\n\n\n\n
<VirtualHost <strong><em>127.0.0.1:8080<\/em><\/strong>><\/code>
    ServerName example.com<\/code><\/p>\n\n\n\n
Save changes.<\/p>\n\n\n\n
Launch Varnish, start it automatically at boot and check service status<\/p>\n\n\n\n
<\/div>
varnishd -V\nsudo systemctl start varnish\nsudo systemctl enable varnish\nsudo systemctl status varnish<\/code><\/pre><\/div>\n\n\n\n
Restart Apache<\/p>\n\n\n\n
<\/div>
sudo systemctl restart httpd<\/code><\/pre><\/div>\n\n\n\n
Open your website in browser to see the \u201cHello, World!\u201d message, e.g.: <\/p>\n\n\n\n
http:\/\/example.com<\/a><\/p>\n\n\n\n
\"Varnish
Step 2. Diagram<\/figcaption><\/figure><\/div>\n\n\n\n
Step 3. Configure Apache HTTP Server As Reverse-Proxy<\/h2>\n\n\n\n
1. Create SSL certificate for Apache<\/h3>\n\n\n\n
For the purpose of this tutorial, we will create self-signed SSL certificates. Nevertheless, you can also install free let\u2019s encrypt certificates using this online manual<\/a>. <\/p>\n\n\n\n
First, you have to be sure that the mod_ssl <\/strong>Apache module is installed on the server.<\/p>\n\n\n\n
<\/div>
dnf install epel-release\nsudo dnf install openssl mod_ssl\nsudo systemctl restart httpd<\/code><\/pre><\/div>\n\n\n\n
Check if mod SSL is enabled:<\/p>\n\n\n\n
<\/div>
apachectl -M | grep ssl<\/code><\/pre><\/div>\n\n\n\n
<\/div>
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout \/var\/www\/example.com\/ssl\/apache-selfsigned.key -out \/var\/www\/example.com\/ssl\/apache-selfsigned.crt<\/code><\/pre><\/div>\n\n\n\n
2. Setting up new Apache virtual host for SSL communication<\/h3>\n\n\n\n
Open your virtual host file: <\/p>\n\n\n\n
<\/div>
sudo vi \/etc\/httpd\/sites-available\/example.com.conf<\/code><\/pre><\/div>\n\n\n\n
Add a new proxy virtual host that will listen to 443 port and redirect all traffic to Varnish (port 80), e.g. perform SSL termination. <\/p>\n\n\n\n
<\/div>
<VirtualHost 127.0.0.1:8080>\n    ServerName example.com\n    ServerAlias www.example.com\n    DocumentRoot \/var\/www\/example.com\/public_html\n    ErrorLog \/var\/www\/example.com\/error.log\n    CustomLog \/var\/www\/example.com\/requests.log combined\n<\/VirtualHost>\n  \n \n<VirtualHost *:443>\n    ServerName varnishtest2.plumrocket.net\n    RequestHeader set X-Forwarded-Proto \"https\"\n \n    ErrorLog \/var\/log\/httpd\/external-https_error.log\n    CustomLog \/var\/log\/httpd\/external-https_access.log combined\n \n    SSLEngine On\n    SSLCertificateFile \/etc\/ssl\/certs\/apache-selfsigned.crt\n    SSLCertificateKeyFile \/etc\/ssl\/certs\/apache-selfsigned.key\n \n    ProxyPreserveHost On\n    ProxyPass \/ http:\/\/127.0.0.1:80\/\n    ProxyPassReverse \/ http:\/\/127.0.0.1:80\/\n<\/VirtualHost><\/code><\/pre><\/div>\n\n\n\n
Save changes and restart Apache<\/p>\n\n\n\n
<\/div>
sudo systemctl restart httpd<\/code><\/pre><\/div>\n\n\n\n
\"Configuration
Step 3. Diagram<\/figcaption><\/figure><\/div>\n\n\n\n
Step 4. Testing<\/h2>\n\n\n\n
Open your domain in the web browser to test if the Varnish Cache is working properly:<\/p>\n\n\n\n
https:\/\/example.com<\/a> <\/p>\n\n\n\n
Run one of the following three commands from shell to test varnish while simultaneously refreshing the web page:<\/p>\n\n\n\n
<\/div>
varnishlog\nvarnishtop\nvarnishstat<\/code><\/pre><\/div>\n\n\n\n
Enter Ctrl + C<\/code> to stop the above commands from running.<\/p>\n\n\n\n
If you experience any errors, it’s always wise to test each portion of our setup separately. If you look at diagram 3 above, you will see that our setup consists of 3 logical sections – Apache frontend, Varnish, and Apache backend.  <\/p>\n\n\n\n
Test Apache backend to see if the virtual host is accessible from the shell:<\/p>\n\n\n\n
<\/div>
curl http:\/\/127.0.0.1:8080\/<\/code><\/pre><\/div>\n\n\n\n
Test Varnish Cache to see if it is accessible from the shell:<\/p>\n\n\n\n
<\/div>
curl http:\/\/127.0.0.1:80\/<\/code><\/pre><\/div>\n\n\n\n
Finally, test the Apache frontend from the shell: <\/p>\n\n\n\n
<\/div>
curl https:\/\/127.0.0.1\/<\/code><\/pre><\/div>\n\n\n\n
Summary<\/h2>\n\n\n\n
Varnish is useful to speed up site load time and we oftentimes suggest our clients optimize their Magento store performance<\/a>. Please don’t hesitate to contact us<\/a> if you need assistance speeding up your Magento store. If you find this tutorial useful, please like and share it with the world.<\/p>\n","protected":false},"excerpt":{"rendered":"
In this guide, we will show you how to install and configure the Varnish cache for the Apache webserver with SSL termination. One limitation of Varnish Cache is that it is designed to accelerate HTTP, not the secure HTTPS protocol. Therefore, some workarounds must be performed to allow Varnish to work on SSL enabled website. <\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[143],"tags":[155,158],"yoast_head":"\nHow To Configure Varnish + Apache with SSL Termination - Magento Tutorials for Beginners & Professionals<\/title>\n<meta name=\"description\" content=\"Learn how to install and configure the Varnish cache for the Apache webserver with SSL termination. Apache will act as a reverse proxy and backend server.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/plumrocket.com\/learn\/ssl-varnish-apache\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How To Configure Varnish + Apache with SSL Termination - Magento Tutorials for Beginners & Professionals\" \/>\n<meta property=\"og:description\" content=\"Learn how to install and configure the Varnish cache for the Apache webserver with SSL termination. Apache will act as a reverse proxy and backend server.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/plumrocket.com\/learn\/ssl-varnish-apache\" \/>\n<meta property=\"og:site_name\" content=\"Magento Tutorials for Beginners & Professionals\" \/>\n<meta property=\"article:published_time\" content=\"2021-12-16T15:23:33+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-04-03T11:45:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/plumrocket.com\/learn\/wp-content\/uploads\/2021\/11\/apache_varnish_1.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"6 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","_links":{"self":[{"href":"https:\/\/plumrocket.com\/learn\/wp-json\/wp\/v2\/posts\/995"}],"collection":[{"href":"https:\/\/plumrocket.com\/learn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/plumrocket.com\/learn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/plumrocket.com\/learn\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/plumrocket.com\/learn\/wp-json\/wp\/v2\/comments?post=995"}],"version-history":[{"count":29,"href":"https:\/\/plumrocket.com\/learn\/wp-json\/wp\/v2\/posts\/995\/revisions"}],"predecessor-version":[{"id":2375,"href":"https:\/\/plumrocket.com\/learn\/wp-json\/wp\/v2\/posts\/995\/revisions\/2375"}],"wp:attachment":[{"href":"https:\/\/plumrocket.com\/learn\/wp-json\/wp\/v2\/media?parent=995"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/plumrocket.com\/learn\/wp-json\/wp\/v2\/categories?post=995"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/plumrocket.com\/learn\/wp-json\/wp\/v2\/tags?post=995"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}