7

I'll try to explain my issue.

I'm working on HaProxy 1.5.8 / apache 2.2, and I try to do some SSL configuration, but I fail, and fail, and fail.

Let's see some logs:

Haproxy Logs

Aug 13 17:00:28 localhost haproxy[10930]: x.x.x.x - - [13/Aug/2015:15:00:28 +0000] "URLxxxxx HTTP/1.1" 502 +656 "" "" 50567 131 "FT-https-in~" "BK-https-out" "myserver-https" 13 0 1 -1 +17 PH-- 0 0 0 0 0 0 0 "" "" 

Apache Error Logs

[Thu Aug 13 17:02:38 2015] [debug] ssl_engine_kernel.c(1903): OpenSSL: Exit: error in SSLv2/v3 read client hello A
[Thu Aug 13 17:02:38 2015] [info] [client haproxy-server] SSL handshake failed: HTTP spoken on HTTPS port; trying to send HTML error page
[Thu Aug 13 17:02:38 2015] [info] SSL Library Error: 336027804 error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request speaking HTTP to HTTPS port!?

My HaProxy configuration :

# - Frontend - HTTPS in
frontend FT-https-in
bind *:443 ssl crt /etc/haproxy/ssl/my_cert.pem
log global
option forwardfor except 127.0.0.1
option httplog clf
option log-separate-errors
option logasap
redirect scheme https if !{ ssl_fc }
default_backend BK-https-out


# - Backend - HTTPS out
backend BK-https-out
mode http
option forwardfor except 127.0.0.1/8 header X-Forwarded-For
log global
option httplog clf
option tcplog
option http-pretend-keepalive
option http-server-close
# pool de serveur du backend
server myserver-https x.x.x.x:443 check

I tried to fix my issue with headers configuration like :

 http-request set-header X-Forwarded-Port %[dst_port]
 http-request add-header X-Forwarded-Proto https if { ssl_fc }
 http-request add-header X-Proto https if { ssl_fc }
 http-request set-header X-SSL %[ssl_fc]

My pem file is build like this : crt / key / bundle

But issue still here. If someone could have an idea to help me!

Thanks

8

You need to tell HAproxy that the backend server is using SSL:

server myserver-https x.x.x.x:443 ssl check verify none

The 'verify none' part tells haproxy not to verify the certificate chain. I've included it, but it may not be necessary.

You shouldn't need any of the header lines you indicated unless you want them.

  • 1
    Thank you! I spent the better half of my day trying to troubleshoot this. – Taylor Glaeser Nov 30 '17 at 5:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.