Apache HTTP SSL certificate with Tomcat AJP

http://www.zeitoun.net/articles/configure-mod_proxy_ajp-with-tomcat/start
You just have to create the AJP connector in the conf/server.xml file like that:
<Connector port="8009" enableLookups="false" redirectPort="8443" protocol="AJP/1.3" />

http://www.zeitoun.net/articles/client-certificate-x509-authentication-behind-reverse-proxy/start
Between Apache HTTP and Tomcat AJP


<IfDefine SSL>
<IfDefine !NOSSL>

ProxyRequests On
ProxyVia On

ProxyPreserveHost On

Listen 1979
NameVirtualHost *:1979
<VirtualHost *:1979>
   ServerName localhost

   ErrorLog /var/log/apache2/1979.error.log
   CustomLog /var/log/apache2/1979.access.log combined

   SSLEngine On
   SSLCertificateFile    /etc/apache2/ssl/mycert.crt
   SSLCertificateKeyFile /etc/apache2/ssl/mycert.key

   SSLCACertificateFile /etc/apache2/ssl/client-accepted-ca-chain.crt
   SSLVerifyClient optional
   SSLVerifyDepth 2

   # this option is mandatory to force apache to forward the client cert data to tomcat
   SSLOptions +ExportCertData

   <Proxy *>
     AddDefaultCharset Off
     Order deny,allow
     Allow from all
   </Proxy>

   ProxyPass / ajp://localhost:8009/
   ProxyPassReverse / ajp://localhost:8009/

</VirtualHost>

Generic Proxy with client certificate header
Listen 1981
NameVirtualHost *:1981
<VirtualHost *:1981>
   ServerName localhost

   ErrorLog /var/log/apache2/1981.error.log
   CustomLog /var/log/apache2/1981.access.log combined

   # activate HTTPS on the reverse proxy
   SSLEngine On
   SSLCertificateFile    /etc/apache2/ssl/mycert.crt
   SSLCertificateKeyFile /etc/apache2/ssl/mycert.key

   # activate the client certificate authentication
   SSLCACertificateFile /etc/apache2/ssl/client-accepted-ca-chain.crt
   SSLVerifyClient require
   SSLVerifyDepth 2

   <Proxy *>
     AddDefaultCharset Off
     Order deny,allow
     Allow from all
   </Proxy>

   # initialize the special headers to a blank value to avoid http header forgeries
   RequestHeader set SSL_CLIENT_S_DN    ""
   RequestHeader set SSL_CLIENT_I_DN    ""
   RequestHeader set SSL_SERVER_S_DN_OU ""
   RequestHeader set SSL_CLIENT_VERIFY  ""

   <Location />
     # add all the SSL_* you need in the internal web application
     RequestHeader set SSL_CLIENT_S_DN "%{SSL_CLIENT_S_DN}s"
     RequestHeader set SSL_CLIENT_I_DN "%{SSL_CLIENT_I_DN}s"
     RequestHeader set SSL_SERVER_S_DN_OU "%{SSL_SERVER_S_DN_OU}s"
     RequestHeader set SSL_CLIENT_VERIFY "%{SSL_CLIENT_VERIFY}s"

     ProxyPass          http://localhost:50161/
     ProxyPassReverse   http://localhost:50161/
   </Location>
</VirtualHost>


</IfDefine>
</IfDefine>


Tomcat SSL
- create conf/tomcat.jks with a valid server key
- copy cert login module into tomcat lib
- http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html
- import belg root cert

server.xml
<Connector
           port="9443" maxThreads="20"
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="./conf/tomcat.jks" keystorePass="apogado"
           truststoreFile="./conf/tomcat.jks" truststorePass="apogado"
           clientAuth="true" sslProtocol="TLS"/>

      <Realm
        className="org.apache.catalina.realm.JAASRealm"
        appName="CertLoginRealm"
        userClassNames="com.apogado.midoffice.auth.CertUserPrincipal"
        roleClassNames="com.apogado.midoffice.auth.CertRolePrincipal" />

http://www.byteslounge.com/tutorials/jaas-authentication-in-tomcat-example
Tomcat login module
C:\programs\tomcat-6.0.37>set JAVA_OPTS= "-Djava.security.auth.login.config==$CA
TALINA_BASE/conf/jaas.config"

conf/jaas.config:
CertLoginRealm {
    com.apogado.midoffice.auth.CertLoginModule required;
};