haproxy ssl 配置方式

Posted 星辰大海ゞ

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了haproxy ssl 配置方式相关的知识,希望对你有一定的参考价值。

1、haproxy 本身提供ssl 证书,后面的web 服务器走正常的http 

2、haproxy 本身只提供代理,后面的web服务器https

第一种方式

需要编译haproxy 支持ssl,编译参数:   

# yum install openssl-devel -y
# wget http://haproxy.1wt.eu/download/1.5/src/devel/haproxy-1.5-dev19.tar.gz
# tar -zxvf haproxy-1.5-dev19.tar.gz ; cd haproxy-1.5-dev19
# make TARGET=linux26 USE_OPENSSL=1 ADDLIB=-lz # ldd haproxy | grep ssl libssl.so.10 => /usr/lib64/libssl.so.10 (0x00007fb0485e5000)

haproxy.cfg 配置:

frontend https_frontend
  bind *:443 ssl crt /etc/ssl/certs/servername.pem
  mode http
  option httpclose
  option forwardfor
  reqadd X-Forwarded-Proto:\ https
  default_backend web_server

backend web_server
  mode http
  balance roundrobin
  cookie SERVERID insert indirect nocache
  server s1 192.168.250.47:80 check cookie s1
  server s2 192.168.250.49:80 check cookie s2
注意:这里的pem 文件是下面两个文件合并而成: # cat servername.crt servername.key
|tee servername.pem

按照如上规则如果多个站点就可以使用同样的规则 bind *:443  ssl  crt  $filepath  crt $file2path  crt $file3path

第二种方式配置

不需要重新编译支持ssl,简单方便。需要后面的web服务器配置好ssl 即可。

frontend https_frontend
  bind *:443
  mode tcp
  default_backend web_server

backend web_server
  mode tcp
  balance roundrobin
  stick-table type ip size 200k expire 30m
  stick on src
  server s1 192.168.250.47:443
  server s2 192.168.250.49:443
  
  注意,这种模式下mode 必须是tcp 模式

 

haproxy.cfg示例文件:

global
        maxconn 64000
        log 127.0.0.1 local0
        uid 99
        gid 99
        daemon
defaults
        log     global
        mode    http
        option  dontlognull
        retries 3
        option  redispatch
        option  httpclose
        balance roundrobin
        maxconn 64000
        timeout connect 5000
        timeout client 50000
        timeout server 50000
frontend yidonghttps-in bind *:443 mode tcp default_backend yidongclient_server_https
frontend http-in bind *:80 mode http log global option httplog option forwardfor
acl host_manager_uhouse hdr_beg(host)
-i manager.u.house.com use_backend manager_uhouse_server if host_manager_uhouse
backend yidongclient_server_https
        mode tcp
        stick-table type ip size 200k expire 30m
        stick on src
        option ssl-hello-chk
        option httpchk OPTIONS * HTTP/1.1\r\nHost:\ ihouse.ifeng.com
        server yidonghttps_168 10.0.10.168:443
backend manager_uhouse_server
        balance source
        option httpchk HEAD /httpchk.jsp HTTP/1.1\r\nHost:\ manager.u.house.com
        server mannager_uhouse_48 10.0.10.48:8081 weight 1 check inter 5000 rise 2 fall 5
        server mannager_uhouse_49 10.0.10.49:8081 weight 1 check inter 5000 rise 2 fall 5

 

 

 

 

 

 

 

 

 

 

以上是关于haproxy ssl 配置方式的主要内容,如果未能解决你的问题,请参考以下文章

Haproxy支持SSL配置

haproxy代理https配置方法

haproxy代理https配置方法

HAProxy安装配置SSL

ini Docker注册表的Haproxy SSL反向代理配置

haproxy 关闭ssl3