0

Im looking If is possible to use haproxy to balance mysql servers with ssl. Only Im finding how to use with http but in this case we need to enable this option.

For now specific config is

listen mysql-cluster
   bind 0.0.0.0:3307 ssl crt /etc/ssl/certs/cert.pem
   mode tcp   
   option mysql-check user admin  
   server mysql1 192.168.1.110:3307

Which options I need to use to connect to servers directly without frontend?

If I comment ssl part

   bind 0.0.0.0:3307 #ssl crt /etc/ssl/certs/cert.pem

Connect perfectly, so what i need to add?

  • in haproxy, you need to define a frontend and the backend, in the backend you place your servers. – c4f4t0r Oct 29 '18 at 12:02
  • Im looking to redirect becaue is and RDS instance and I need to enable public IP. I was reading and not always you need to has a frontend. – deconya Oct 29 '18 at 13:22
  • yes, is true, you can only use listen, but any, what issue do you have in archive what you want to do? – c4f4t0r Oct 29 '18 at 13:29
  • I would like to offer ssl connection from haproxy but connecting to the mysql server, – deconya Oct 29 '18 at 13:36
1

One important information is missing: what is your client, how do you connect to your haproxy-ssl-proxyied Mysql ?

In your configuration Haproxy doesn't "speak" mysql, it only speak TCP, adding the SSL option will add a generic SSL layer on top of the TCP stream which will be forwarded As-is.

If you use a standard mysql client it won't work, handling SSL is "native" in the mysql protocol and most probably not by simply "envelop-ing" the stream usung an SSL layer so it won't work with your setup.

If you keep this configuration you will need something like "stunnel" on the other end of your connection to provide the native "un-SSL" stream to the clients.

You should setup your mysql server with a valid SSL configuration and use haproxy in tcp mode + proxy-protocol to delegate everything and the original IP to your mysql

  • I will use a client to connect wih java connector, but haproxy needs to accept any connection to server. Is obvious that we will use client with ssl support. But for now problem is justly how to connect with ssl between haproxy and server. – deconya Nov 7 '18 at 14:52
  • Well then as i said, you can't use haproxy's ssl tunnel option to do this, you HAVE to set-up the mysql server correctly – silmaril Nov 7 '18 at 14:55
  • ok, what does it mean proxy-protocol? Mysql server is enable to use ssl but only to check CA certificate. This is howto using mysql client docs.aws.amazon.com/AmazonRDS/latest/UserGuide/… – deconya Nov 9 '18 at 10:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.