diff --git a/roles/httpd/reverseproxy/templates/reversepassproxy.fas.conf b/roles/httpd/reverseproxy/templates/reversepassproxy.fas.conf
new file mode 100644
index 0000000000..9d7d0cebe7
--- /dev/null
+++ b/roles/httpd/reverseproxy/templates/reversepassproxy.fas.conf
@@ -0,0 +1,12 @@
+# pass ca requests on needed for CRL
+ProxyPass /ca http://fas1/ca/
+ProxyPassReverse /ca http://fas1/ca/
+
+# fas1 is the only place for gencert right now
+RewriteEngine On
+RewriteRule /accounts/user/dogencert http://fas1/accounts/user/dogencert [P,L]
+
+ProxyPassReverse /accounts/user/dogencert http://fas1/
+
+ProxyPass {{localpath}} {{proxyurl}}/{{remotepath}}
+ProxyPassReverse {{localpath}} {{proxyurl}}/{{remotepath}}