Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Please recommend reverse SSL proxy. Need to receive HTTPS traffic at 443 port on Load balancer and then forward it to 443 port on web servers.

HAProxy doesn't support HTTPS Varnish as well Stunnel stucks here

I see two ways: trying to use iptables or check if nginx fit our requirements.

Please advice what do you guys using to balance SSL traffic.

share|improve this question

closed as off-topic by kasperd, womble Sep 17 '15 at 9:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

Nginx can do this for you and more. http://www.cyberciti.biz/faq/howto-linux-unix-setup-nginx-ssl-proxy/

share|improve this answer
1  
Thanks, checking it out – user76667 Nov 9 '11 at 20:24

F5 BigIP LTM's work great...but they aren't free...

share|improve this answer
    
it seems they have hardware decisioins only, isn't it? – user76667 Nov 9 '11 at 20:24
    
Yep. They work well though. – mahnsc Nov 9 '11 at 20:44
    
No, you can use the Virtual Edition, however you lose a few things when you do this. First, the F5 hardware accelerates specific types of TCP traffic and secondly, they have a dedicated hardware SSL add-in card. When trying to encrypt and decrypt SSL traffic, this takes a large amount of load off of the software/processor that you don't get with Virtual Edition. – James Shewey Mar 1 '15 at 18:11

HAProxy isn´t a reverse proxy, if you only need the load balancer feature you can still use HAProxy, using mode tcp to Load balance to your SSL servers,

haproxy (mode tcp) => ssl-servers

Or, you can use a nginx frontent to 'remove' the ssl, and then forward it to your webservers in plain-text...

nginx(ssl)=>haproxy(mode http)=>web-servers

BTW, if you add varnish (after remove the ssl encryption), verify if you aplication is sending the correct Cache-Control headers, so your reverse proxy only caches static contents, and not the private stuff. Take a look on http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.