HAProxy : SSL Settings

HAProxy : SSL Settings 2015/02/18

Configure HAProxy with SSL. The connection between HAproxy and Clients are encrypted with SSL. ( HAproxy - backends are normal ) This example based on the environment like follows. | -------+----------------------------------------------- | +-------------------+--------------------+ |10.0.0.30 |10.0.0.31 |10.0.0.32 +-----+-----+ +-------+------+ +-------+------+ | Frontend | | Backend#1 | | Backend#2 | | HAProxy | | Web Server | | Web Server | +-----------+ +--------------+ +--------------+

[1]	Create SSL certificates.

[root@dlp ~]#  cd /etc/pki/tls/certs  [root@dlp certs]#  openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/pki/tls/certs/haproxy.pem -out /etc/pki/tls/certs/haproxy.pem -days 365  Generating a 2048 bit RSA private key ......++++++ .......++++++ writing new private key to '/etc/pki/tls/certs/haproxy.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: JP # country State or Province Name (full name) [Some-State]: Hiroshima     # state Locality Name (eg, city) []: Hiroshima # city Organization Name (eg, company) [Internet Widgits Pty Ltd]: GTS     # company Organizational Unit Name (eg, section) []: Server World     # department Common Name (eg, YOUR name) []: dlp.server.world     # server's FQDN Email Address []: root@server.world # admin email address [root@dlp certs]#  chmod 600 haproxy.pem

[2]	Configure HAProxy for SSL.

[root@dlp ~]#  vi /etc/haproxy/haproxy.cfg # add in the "global" section global       # max per-process number of SSL connections maxsslconn 256       # set 2048 bits for Diffie-Hellman key tune.ssl.default-dh-param 2048 # add follows in the "frontend" section frontend http-in bind *:80       # specify port and certs bind *:443 ssl crt /etc/pki/tls/certs/haproxy.pem [root@dlp ~]#  systemctl restart haproxy

[3]	Make sure all works fine to access to the frontend server from a Client with HTTPS like follows.