Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am setting up HAProxy to load balance between two web servers. Some of the pages on the site require SSL. Stunnel is handling the https connections and passing them off to haproxy (Stunnel contains the cert). HAProxy will hand off requests to the web servers using http. Will containing the web servers and haproxy in an internal network be enough to be PCI compliant? Is there anything I need to watch out for?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

4.1 Use strong cryptography and security protocols (for example, SSL/TLS, IPSEC, SSH, etc.) to safeguard sensitive cardholder data during transmission over open, public networks.

Yes, your architecture is appropriate to the standard.

https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf

share|improve this answer
    
If for some reason your link between HAProxy and the webservers needs to pass through an open network, you would need to route HAProxy to another stunnel (configured as a client) that forwards on to the webserver. –  Manfre Feb 8 '12 at 20:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.