Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to figure out how to set up my architecture for a socket.io app that will require both https and wss connections. I've found many tutorials on the web suggesting that you use something like stud or stunnel in front of haproxy, which then routes your unencrypted traffic to your app. If I were to go this route, is it suggested that haproxy and the ssl terminator be on separate instances, or is it fine if they are on the same EC2 server instance?

If I do not want to use a separate ssl terminator, could I use haproxy to terminate the ssl? Or instead would it be possible to proxy these https and wss connections to my application and have the node app terminate the ssl itself?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

The last I checked, haproxy still didn't have SSL termination as a feature. This is why you're seeing recommendations to put stunnel in front of it as a way to provide just that feature.

In my opinion, it's generally OK to host both stunnel and haproxy on the same system. Even EC2 micro instances can drive a good chunk of SSL traffic, and the larger instances are even better at it. You might run into some problems at high scale where the number of sockets that need to get opened to forward all this traffic around might run into limits, but that's kind of a nice problem to have.

I do know of one SSL-enabled load-balancer, and that's Pound. Not nearly as featured as HAproxy, but if all you need is SSL-termination and some back-end servers it's good enough. Chances are you'll have to build your own packages though, so that might rule it out.

share|improve this answer
2  
Yes haproxy supports SSL termination since 1.5-dev12, which greatly simplifies SSL termination and session sharing. –  Willy Tarreau Sep 13 '12 at 7:04
    
@WillyTarreau oooOOOoooo.... thanks for sharing! –  sysadmin1138 Sep 13 '12 at 11:46
    
For performance reasons it makes more sense to run them both on the same machine. But why not use something which provides both HA and SSL; I'm thinking specifically of Apache Traffic Server, which also gives you HTTP caching –  symcbean Sep 13 '12 at 15:32

Give a try to haproxy-1.5-dev12, it supports SSL offloading and will make your life easier :-)

share|improve this answer
    
I can confirm it makes your life easier! –  AndyD Dec 21 '12 at 16:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.