HAProxy not working with SSL.

Foloder · Jan 4, 2020, 5:04 PM

Hello folks,
I cannot achieve a proper way to make HAProxy working.
What I want to achieve is to make multiple websites on different server who are inside my DMZ (with their own IP Address and own SSL certificate) available on the internet. I can make this work for my http (port 80) website but not for my https (port 443) websites.
So something like this.

WAN -> virtual (PFsense) -> virtual (DMZ) -> virtual (oneOfMyWebsite):443

I deleted my actual configuration file, but I made one with what to think to be correct:

        maxconn                 10000
        stats socket /tmp/haproxy.socket level admin
        uid                     80
        gid                     80
        nbproc                  1
        hard-stop-after         15m
        chroot                          /tmp/haproxy_chroot
        daemon
        server-state-file /tmp/haproxy_server_state

listen HAProxyLocalStats
        bind 127.0.0.1:4444 name localstats
        mode http
        stats enable
        stats admin if TRUE
        stats show-legends
        stats uri /haproxy/haproxy_stats.php?haproxystats=1
        timeout client 5000
        timeout connect 5000
        timeout server 5000

frontend FrontEnd-SNI
        bind                    192.168.1.101:443 name 192.168.1.101:443
        mode                    tcp
        log                     global
        timeout client          30000
        tcp-request inspect-delay       5s
        acl                     portalsni       req.ssl_sni -i portal.example.org
        tcp-request content accept if { req.ssl_hello_type 1 }
        use_backend backendSNI_ipvANY  if  portalsni

backend backendSNI_ipvANY
        mode                    tcp
        id                      100
        log                     global
        timeout connect         30000
        timeout server          30000
        retries                 3
        option                  httpchk OPTIONS /
        server                  portal 1.2.3.4:443 id 101 check inter 1000

I don't want to use SSL offloading, I prefer to manage everything on the webservers.
My Pfsense is not running on the 443 ports so it should not interfere with the HAProxy utility.
I've a rule that opens in the WAN the 443 port.

Thanks for your help.

PiBa · Jan 5, 2020, 1:26 AM

@Foloder
So i presume portal.example.org resolves to the IP 192.168.1.101 on the client machine your testing from?
Also check haproxy's stats page to verify that the server shows as 'up', it probably needs 'ssl-checks' enabled on the backend server if it isn't.

Other that that the config seems fine..