Let's say that we have haproxy in front of 2 apache:
+----> Apache (10.0.0.2)
Haproxy (10.0.0.1) --|
+----> Apache (10.0.0.3)
- Haproxy is configured to load balance traffic based on URI (needs to see URI so have to see content of HTTP)
- Apache is hosting a large amount of domains
- Every domain is accessible in HTTPS via haproxy that offloads SSL and initiate HTTP connection to Apache
- Every domain has its own SSL certificate (no SAN or wildcard cert)
I saw that Haproxy allows us to give a directory with many certificates but I didn't manage to make it work with another thing that a single certificate.
Here is my (simplified) configuration:
global
[...]
# Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
# Default ciphers to use on SSL-enabled listening sockets.
ssl-default-bind-options no-sslv3
ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
# For backends connections
ssl-default-server-options no-sslv3
ssl-default-server-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
frontend https_frontend
bind 10.0.0.1:443 ssl crt /etc/ssl/private/mycerts/mydomain.pem # HERE WE WANT A DIRECTORY INSTEAD OF A FILE
default_backend apache_backend
backend apache_backend
cookie SRVID insert indirect nocache
# Backends
server apache1 10.0.0.2:80 check maxconn 64
server apache2 10.0.0.3:80 check maxconn 64
# Load Balancing - URI Consistent
balance uri
hash-type consistent
# Options
option http-keep-alive