Running behind an httpd

It is possible to run the SMP on an Tomcat (or the like) that is proxied via an httpd (e.g. per mod_jk or mod_proxy) to the public. In this case and the SMP runs on Tomcat in a context different than ROOT, it is important to

• set the smp.forceroot configuration property to true (see Configuration for details) and
• to change the path of the SMP session cookie (usually JSESSIONID) from the original path to the destination path as well

Assuming you want to proxy the SMP from a local Tomcat (with active AJP connector on port 8009) running in context path /smp to the domain test-smp.example.org you might consider adding something (similar to) the following to your httpd VirtualHost configuration.

Note: according to the Peppol SMP specification 1.4.0 the SMP must be publicly reachable via TLS on port 443, so httpd terminates TLS as shown below (an SSL VirtualHost on port 443). Adjust the certificate paths to your setup.

   ServerName  test-smp.example.org:443

   SSLEngine on
   SSLCertificateFile    /etc/ssl/certs/test-smp.example.org.crt
   SSLCertificateKeyFile /etc/ssl/private/test-smp.example.org.key

   AllowEncodedSlashes NoDecode

   ProxyPass         /  ajp://127.0.0.1:8009/smp/ nocanon
   ProxyPassReverse  /  ajp://127.0.0.1:8009/smp/
   ProxyPassReverse  /  https://test-smp.example.org/smp/
   
   # Change the path of the cookies as well (from "/smp" to "/")
   ProxyPassReverseCookiePath /smp /

Note: You can also proxy to http instead of ajp for the internal connection to Tomcat. In that case replace ajp://127.0.0.1:8009/smp/ with http://127.0.0.1:8080/smp/ (assuming Tomcat running on port 8080). Only the internal hop uses plain HTTP; the public connection must use TLS.