PfSense HAProxy certificate export import

[VMlabman]

@viragomann

Hello,

I added the Firewall Rule and I get : ( Warning: Potential Security Risk Ahead )

When I have SSL Offloading Checked on External address in the Frontend. i get:
( Warning: Potential Security Risk Ahead )

When I have SSL Offloading unchecked on External address in the Frontend. i get:
400 Bad Request The plain HTTP request was sent to HTTPS port

I tried to add my NAS device in as a test to see what if might work and I can't get the Backend to start no matter what I set the Health check method to Basic or HTTP. I did come across this digging around on the forums to find there may be an issue with changing the setting in the Backend and having to copy it or re build it. I did both with out a change in the error. I even used a different Frontend to test too. https://forum.netgate.com/topic/182581/may-have-found-a-bug-in-haproxy-using-ssl-backend-ssl-health-check link text

WARNING] (12356) : config : Server Qnap-01_BE_ipvANY/qnap-01 is DOWN, changed from server-state after a reload. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.

I am going to try to re install the package from package manager to see it it fixes anything.

Any suggestions ?

Thank you,

[viragomann]

@VMlabman
In the pfSense GUI or in the browser?
If in the browser, from where?
Something more then this?

[VMlabman]

@viragomann

I will include screenshots as well

On pfSense in HAProxy When I have SSL Offloading Checked on External address in the Frontend. i get: ( Warning: Potential Security Risk Ahead )

When I have SSL Offloading unchecked on External address in the Frontend. i get:
400 Bad Request The plain HTTP request was sent to HTTPS port

[viragomann]

@VMlabman
I guess, your browser is not accepting the SSL certiificate, if SSL is enabled.
Hit the Advanced button to show error details. Also you can show the certificate.

You need to assign a certificate from a trusted CA to the frontend to load the page in the browser without issues.

If you disable SSL, it would be a wrong configuration, so forget this error 400. If the browser tries to connect to https site (port 443) it's expecting to get an SSL certificate.

[VMlabman]

@viragomann

I am using a .wildcard certificate from my pfSense trusted CA to the frontend. I also imported the same Cert into the Printer and NAS. I can create a Cert individually for each of them. I see where in the Edit HAProxy Backend server pool Under Backend I can set a CA: and/or a Client certificate: Shouuld I create the Certs and import them into the devices and list them under the Backend for each host?
Here are some screenshots of the Browser Errors I get in FireFox and Google Chrome. Maybe shis will point at somthing.


[viragomann]

@VMlabman
So this is a self-signed certificate and the browsers will not trust it.
You can install the CA certificate in the browser to trust all certs issued by it. However, you have to do this on each unique browser, which you want to access HAproxy.

In your initial post you wrote that you enable ACME. So my assumption was, that you got a Lets Encrypt certificate to use in HAproxy.
However, you will need a real public domain name to do this.

My suggestion with the local CA was to secure the traffic inside your network. As I wrote above, you can issue (long validity period) certificates from it and install it on your backend devices. So HAproxy can access the backend servers via HTTPS, and will trust the certs, since they issued from a CA on pfSense itself.

[VMlabman]

@viragomann

I am going to go with your suggestion and use HAProxy and pfSence CA's for the few devices. So that is my goal here a Printer and a NAS. I takeing it alittle bit at a time this go at it.

1. Create CA Root in pfSense

2. Create CA Intermediate in PfSense

3. Create / Sign / Export Devise Certs

4. Get Certs onto Devices

5. HAProxy Basic Setup

Thank you,

[VMlabman]

@viragomann

Question when I am creation a Certificate Request from the device and filling in the Common Name Field. Is is case sensitive and is it the FQDN or just the HIOSTNAME?

Thank you,

[viragomann]

@VMlabman
The common name has to be the FQDN.

[VMlabman]

@viragomann

thanks

[viragomann]

@VMlabman
When you enter the FQDN into the browser with "https://" in front of it, the browser expects to get a certificate from the server, in which the common name matches the entered / requested host name (FQDN) in the address line.
If they don't match the browser will not load the website.

[VMlabman]

@viragomann

Thank you so much for everything. I actually got it working thanks to a lot of your help. It is now successfully working on my printer. Also, in the Certificates I realized everything was case sensitive.

Once again, thank you for the education and all your time and effort definitely appreciated

[viragomann]

@VMlabman
Glad that you got it working as desired finally.

[VMlabman]

@viragomann

Another question re this same project. Does HAProxy support self signed Certificates? If so anything special I need to keep in mind when creating it? The NAS can’t do a CSR. I am having issues adding the my QNAP NAS to HAProxy. Yet, I know HAProxy is working on my printer so I am just adding a new backend and adding it the the same frontend. Other then the NAS is on port 5553 os easy change on that part in the Backend.

Thanks you,

[viragomann]

@VMlabman said in PfSense HAProxy certificate export import:

Does HAProxy support self signed Certificates?

Yes, if you have "SSL checks" unchecked.

The NAS can’t do a CSR.

Does it also not support the import of a certificate?

If you generate the certificate from a CA on pfSense, HAproxy should trust it anyway.

[VMlabman]

@viragomann

However, if I uncheck the SSL box and AJ proxy, does that make the connection between AA proxy and the Cell science certificate unencrypted

[viragomann]

@VMlabman
If you enable the encryption in the backend, HAproxy requires an SSL certificate from the backend server to connect and the traffic is then encrypted based on this cert, whether it's validated or not.

[VMlabman]

@viragomann

So for my nails since I’m having problems importing the certificate I’ll just create a self science certificate on the NA itself not checked encrypted SSL certificate in H a proxy back end and proxy will still encrypt the traffic. Am I understanding you correctly because I’m still using AJ proxy

[viragomann]

@VMlabman
Yes, of course it does, as "encryption" is checked.

[VMlabman]

@viragomann

Hello,

Add my NAS in I have it all set up using an alternate DNS entry from my standard of it's own in DNS so I can point it to the firewall / HAProxy as I did with my printer.

Qnap-1.myvmlab.net = 10.50.50.200 to the devices IP
mgmtqnap-01.myvmlab.net = 10.50.50.254 to the firewall / HAProxy

When I ping them both I get the correct DNS resolution to the correct IP for the Host Name. When I go to https://mgmtqnap-01.myvmlab.net:5553 the browser both Firefox and Chrome timeout with no resolution or additional error. In HAProxy the backend is up. Note the NAS is using a self signed certificate at the moment. Any ideas?