HAproxy SSL PassThu with SNI



  • Hello! I am trying to setup HAproxy to pass through SSL requests to multiple servers so that multiple different application servers can share one public IP and maintain/renew their own LE SSL certs. I'm running into trouble right off the bat. I setup a separate pfSense VM just for this HAproxy application. The first site I will need to proxy is pfSense itself. I setup HTTP and HTTPS to what I think is correct but it's not working. When I try to connect to the hostname of pfSense, I see the connection in HAproxy stats but my web browser timeouts after a while. Here are my configs (anything left out is default). Any ideas? Thanks!

    HTTP backend:
    efb9663a-01ef-49d7-b22e-fc8769decee0-image.png
    c9d86ecc-534c-40fd-9080-578b623b3010-image.png
    15ed85eb-6161-479d-992c-b88ec8523b76-image.png

    HTTPS Backend
    3f964c0d-4c00-4d05-b78e-b3a5a2436003-image.png
    7f026d11-b312-4f0f-bc08-f23affe1c257-image.png
    da90a8bd-fc27-41cb-8c7c-a94775c896bc-image.png

    HTTP Frontend:
    b4a83300-1bd9-49d2-91b4-57262e553716-image.png
    a4a31273-dac3-434e-86cf-1a6e67154c10-image.png

    HTTPS Frontend:
    bc0826a3-9c63-44c0-baf0-625a3a3fde36-image.png
    ea097fda-7d70-462c-ab11-197066669713-image.png

    Settings:
    4616ac27-b65e-4223-a954-fda75d12c4a8-image.png
    2611fdc6-0d1d-481a-94b0-2be291ac25ee-image.png



  • @MeCJay12
    The port :80 frontend cannot use SNI, as its getting a plain-text request from the browser.. You will have to change that to a frontend of type 'http', and check the Host header..

    You do not want to use certificates in haproxy itself right?, so for the :443 frontend you do not decrypt the traffic, then on the backend you DO encrypt the already encrypted traffic again. So the webserver gets the http traffic in 2 layers of SSL. certainly it wont know what to do with that.. , as such don't select the encrypt checkbox there. (but perhaps do perform the health-checks with ssl so check 'SSLchecks')

    Another possible issue might be the use of the transparentclient-ip feature.. You should select the interface that is connected to the 'webserver' there.. Which in case of the local pfSense webgui im not sure it could work at all.. Try not using that feature as a debugging step, it has that warning text for a reason ;) and even though it doesnt warn about webgui specifically, it certainly worth trying to use it if some kind of 'trouble' is found..


  • LAYER 8 Netgate

    584c8a5f-8466-42f5-afbe-4be601b72f7a-image.png

    I would get it working before enabling things like this too. You really have to know what you are doing to get all of that right.


Log in to reply