Haproxy implementing Multi-Domain certificate HTTPS

[email protected] keys]# OpenSSL Genrsa- outWww.app01.com.key2048Generating RSAPrivateKey2048BitLongmodulus ....+++.....................................+++e is 65537(0x10001) [[email protected] keys]# OpenSSL req-New-key Www.app01.com.key- outWww.app01.com.csrYou is about is asked to enter information that'll be Incorporatedinto your certificate reques T.what You is about to enter isWhat iscalled a distinguished Name or a DN. There is quite a few fields I can leave some blankfor some fields there would be adefaultvalue,if you enter'.'The field would be a left blank.-----Country Name (2Letter Code) [Xx]:cnstate or province name (full name) []:beijinglocality name (eg, city) [Default city]:beijingorganization name (eg, Company) [Default company ltd]:espressos.cnorganizational Unit name (eg, section) []:app Common Name (eg, your name or your server's hostname) []:www.app01.comEmail Address []:[email protected]163. Complease enter the following'Extra'Attributesto be sent with your certificate Requesta challenge password []:an optional company name []:[[email Protect Ed] keys]# LSWWW.APP01.COM.CSR Www.app01.com.key

365 - in Www.app01.com.csr-signkey www.app01.com.key- out www.app01.com.crtSignature Oksubject=/c=cn/st=beijing/l=beijing/o=espressos.cn/ou=app/cn=www.app01.com/[email protected]163 . comgetting Private Key

[email protected] keys]# Cat WWW.APP01.COM.CRT Www.app01.com.key |Tee Www.app01.com.pem-----BEGIN CERTIFICATE-----MIIDKJCCANOCCQDXDEBYNMUGRDANBGKQHKIG9W0BAQUFADCBIJELMAKGA1UEBHMCQ04XEDAOBGNVBAGMB0JLAUPPBMCXEDAOBGNVBACMB0JLAUPPBMCXF Tatbgnvbaomdgvzchjlc3nvcy5jbjemmaoga1uecwwdyxbwmrywfaydvqqdda13d3cuyxbwmdeuy29tmrowgayjkozihvcnaqkbfgtja0aumtyzlmnvbtaefw 0xnjeymtcymdu5mzrafw0xnzeymtcymdu5mzramigkmqswcqydvqqgewjdtjeqma4ga1uecawhqmvpsmluzzeqma4ga1uebwwhqmvpsmluzzevmbmga1uecgw Mzxnwcmvzc29zlmnumqwwcgydvqqldanhchaxfjaubgnvbammdxd3dy5hchawms5jb20xgjaybgkqhkig9w0bcqewc2nrqc4xnjmuy29tmiibijanbgkqhkig 9w0baqefaaocaq8amiibcgkcaqea2uzvjbdyskispolerlcjgq+6mppn+2xvoms0piy+R14ehfkw6sz1o8znl0aqpmzoikvfkvwdnehp0fwjnmzoppprceyvbuhewzdgunopqwkae0agyla5r4hpr30r8hj87pdtp3ukfzbgrzfuqjub ++1eaot3uepkv1tmkd/85ziu7ctuafj+S7L4J0I7LVO3IU3TOZ80KBB+d31p3qcbgenocxns8ohte3xpk4jwcekgtyuvdvy6vzcvcmiwyph7pwc4dwbkmb6ub78pdkg5c6pasfajrejdyjel0duymprl7btgxzqsdpi7bx6lq2hd0 K5MP/divkkz4kzrclxptqidaqabma0gcsqgsib3dqebbquaa4ibaqaoo30ox/Xxpbsjvribcak7zpwnv7pw8kq2sz4lpknvylwipkiromrq6e9zbhdpixu0ic+Anhsej5etb11fwwmxamlmmpwx7ngwsirfxlbkyda5zq8dlzlmfqacaw53o4/6en+hbpxptp0btmznqaf8aivpviraomlsk291+lews/c0atvkz5farjw5ozjddozoy3dornap/Hqon+i07uj8pexnx9p4th2gyxle/7avk46dk7zglg3dpcoverqokchkvszixta5a0el6fpp7r+ou8s4trqy8gb1ecx7/cqui4g8jwsic63pkys9jeelmdpntz1d6uv+Fhuhrueiljax-----END CERTIFICATE----------BEGIN RSA PRIVATE KEY-----Miiepqibaakcaqea2uzvjbdyskispolerlcjgq+6mppn+2xvoms0piy+R14ehfkw6sz1o8znl0aqpmzoikvfkvwdnehp0fwjnmzoppprceyvbuhewzdgunopqwkae0agyla5r4hpr30r8hj87pdtp3ukfzbgrzfuqjub ++1eaot3uepkv1tmkd/85ZIU7CTUAFJ+s7l4j0i7lvo3iu3toz80kbb+d31p3qcbgenocxns8ohte3xpk4jwcekgtyuvdvy6vzcvcmiwyph7pwc4dwbkmb6ub78pdkg5c6pasfajrejdyjel0duymprl7btgxzqsdpi7bx6lq2hd0 K5MP/Divkkz4kzrclxptqidaqabaoibaqctb0hrvjiqtfuihhvawgdx92tcz+cy3+e0n1geee04oua+lhe9cjhiiiex5k03kdpon/Owh25o48laqw+vxjtiqxmq2zj5xg2+umdajpu9zbmrtkcbguujln+Taazq61vzw1im78jqeq0nqdybpnygmejlvkxxva++wvq0bub8/rljjokkipe1e0aegaukvhcdxqurcjfqbzzzz/xumi1gjmlnjw0wb8mxtthq0yeatooqgsadok2bail9lhcw4n4ansod+KGRBBFGK2SSCSK3BVBWMLBX7YQ35HX92U511J42XVG/oxac/LDVJPX20WBQP85CDZAKFYJB48BONOMDAOGBAPUPVUEIGZ6NK0FPQ+7bv0mxtuqga1ozwfcosvtoqs8ch4ki8q9sigutoevl9gkhy/8nsrpj/L204lpo1dkb8ecilo2eqmteq3jwayvuu9tlkdmld3edz7d2zx7s40m4cdof1/aqnbdlbeyzlp7kgtrmxvoumhu8wu7pqqtiidjpaogban7dh8w5n/pdjti50pffruml3u6x9us2pcymp+LIMDMNL22ZFCT8WK6FVLHUAA6PRA4YXEHXOQUNTEIV5SG0AKX2MS0IMUK2CCBOUMRQUX7V0NMW0ICEZ3QRTQZON2YPVSFDALC4KEPF31UBTLBUNX4VBBQ 6tkcx5jvykssvevc7aogbamhy4gg3k7jgrqhf5ubhfaxeyso/uv/TTN1ODPBGAOGDYXLL0ZYTF4DTLFPEBUDX20B9OV8BZXUX2LKGNFQ8M5/1uzz6lmk1tdms1x8nwlqddju2fxg++hmwnzlypow1hdgeb75gv+ljn2iautcekmq46c9/fpgjxvgsb8lfq+nbaogay2iiazkfk5slyalih057uxhgwd0a5xa5n+Bg1hu8mbb1mwc3seatd36hi7dvye/jxn8uilecgakjjjrhkqp68tnrbwv5miofjtvn1fqdoql1vskmpdiz6iqvfdxn0euecswk0gy8fhicr2crzomn1sbo2ttwjujns4en5nhhyq0cgyealp6x GWJ+dih/uqgrrqa5bxb3gylypmoeunjk/3owh+tl+/vzprjyiez9jsj7e3dghwc9l/mty8rweq30b8qca9trzilckgltlhuivqjnlklas3t+48qafal1ev3/gjmiw06u/ot8yl5d8zzyk1r4ydvjousdpfrse6jwq9wrgoo=-----END RSA PRIVATE KEY-----

[Email protected] keys]# lswww.app01.com.crt  www.app01.com.csr  www.app01.com.key  Www.app01.com.pem

According to the above method, the raw Www.app02.com.pem

[email protected] keys]# OpenSSL Genrsa- outWww.app02.com.key2048Generating RSAPrivateKey2048BitLongModulus ... .... ... ... ... ... ... ... ... ... .... ... .... ... .... ... .... ... ..... ..... ..... ..... ..... ... .. .... ..... ..... , ... and .... .....+++..................................+++e is 65537(0x10001) [[email protected] keys]# OpenSSL req-New-key Www.app02.com.key- outWww.app02.com.csrYou is about is asked to enter information that'll be Incorporatedinto your certificate reques T.what You is about to enter isWhat iscalled a distinguished Name or a DN. There is quite a few fields I can leave some blankfor some fields there would be adefaultvalue,if you enter'.'The field would be a left blank.-----Country Name (2Letter Code) [Xx]:cnstate or province name (full name) []:beijinglocality name (eg, city) [Default city]:beijingorganization name (eg, Company) [Default company ltd]:espressosorganizational Unit name (eg, section) []:espressoscommon name (eg, your name or y Our server's hostname) []:www.app02.comEmail Address []:[email protected]163. Complease enter the following'Extra'Attributesto be sent with your certificate Requesta challenge password []:an optional company name []:[[email Protect  Ed] keys]# lswww.app01.com.crt Www.app01.com.key WWW.APP02.COM.CSRWWW.APP01.COM.CSR Www.app01.com.pem Www.app02.com.key

[email protected] keys]# OpenSSL x509-req-days365-inchWww.app02.com.csr-signkey Www.app02.com.key- outwww.app02.com.crtSignature Oksubject=/c=cn/st=beijing/l=beijing/o=espressos/ou=espressos/cn=www.app02.com/[email protected]163. comgetting Private key[[email protected] keys]# cat www.app02.com.crt Www.app02.com.key|Tee Www.app02.com.pem-----BEGIN CERTIFICATE-----Miidljccan4ccqcreunuakluydanbgkqhkig9w0baqufadcbjdelmakga1uebhmcq04xedaobgnvbagmb0jlauppbmcxedaobgnvbacmb0jlauppbmcxe Jaqbgnvbaomcwvzchjlc3nvczesmbaga1uecwwjzxnwcmvzc29zmrywfaydvqqdda13d3cuyxbwmdiuy29tmrkwfwyjkozihvcnaqkbfgpja0axnjmuy29tmb 4xdte2mtixnzixmdgymfoxdte3mtixnzixmdgymfowgywxczajbgnvbaytaknomrawdgydvqqidadczwlkaw5nmrawdgydvqqhdadczwlkaw5nmriweaydvqq Kdallc3byzxnzb3mxejaqbgnvbasmcwvzchjlc3nvczewmbqga1ueawwnd3d3lmfwcdaylmnvbtezmbcgcsqgsib3dqejaryky2tamtyzlmnvbtccasiwdqyj KOZIHVCNAQEBBQADGGEPADCCAQOCGGEBAK4XVT3WR0NDQQIJWJLHWZZ4FA/ozqxf4nfg7wwnp4titvnv/T2UDVAGJLLCJCK6CC6ZLXVQ7VHKXVGLMUKHLWGRKXFFD6L1PUS4H5QTT8JFXIVJ+GSYQZXYCEQXOCN4N4YHYC+is0cdapc5qurjxlfja6fja2qjzlh2d2gfuqvod80hhu+lltlw+Hkxuufzbthuudg4wobuvencdwlr1hjqpqmuo9nh8tn6bxltdyiq4qphjsfyqutycbmovuufetp49ovvahdce2qab0mrl32hqltc8frhqf9douknycthi7 KPVCHCPODSEJCJVG34UOSMQTN50VSC2UYFCB9FB8SCAWEAATANBGKQHKIG9W0BAQUFAAOCAQEATHNHS+Zfquf8nuuzn6iyw/u9ip5arsj/13pzjqmmd+eedmw13zdkheihd8bkxparzqq4zkg5bbaj8bfwtwcmoc7mcfmd8rijdatwos15uv7x+jhnxuvwczovft0rnovvg1yep+RQ6HU1ZBJ+yhk6uj2cftzozbzh7+ksgzlohsjmmqronvtnaw7bgqbuguy/FGFS1RFW5XXR1KY02HX58HPTF7GXEPAV596G8HB+8silgkwesl//pyoisbb/ksvg68g7+c8nsods1hci8gtmew+c1b8tvy5xqzqo3t2ob024xknnzkvr0xecor5lojh9elisljcy9s1f/ee2rv2n4g==-----END CERTIFICATE----------BEGIN RSA PRIVATE KEY-----MIIEOWIBAAKCAQEARJG9PFCVSD1COGLAOUFBLNH8D87OPCXG1+dtbcc/i0hnwe/+3zr1uaymwuknwrpwlrmtdvdu8erduawa4qgxccurd8v3ovu+5LGFLBNPYMXEHUN4AZKRNFJX6RE5YFIFJKHJZ6KZQJ1QKLLC5GNCSWNRP+MDZANOUFYPAAW5BU4PZSGG76UTOVB6GTFRR/nu2g5qodhahtruq0j3cwvuena+Qa6j02hy2fofcu0nijdha8clivhc61gjsyi9s58rm/j2i+9qf0j7zbohsauxfafatnzwveep/12I6Q3JY2EJSQLVYFW+gox4lynwdfhq5kzc03ns+Wlztiujv19vywidaqabaoibaqcmrgovqicpnty2tx+5vr5e1ifbhxetam6qktgn+uch20rm42vctxvoztt81ipgifcmwr+Flhogkpzpvgoikwwtj7oh0aokv6gg/2b2lqkofcwwbaqldvugiukq7eyub0e8n2dtcrquku8owfdlaxs4ae5emoifigjiybqb8vhogxxhouutgvriuceutdnfsazgfep6zia82ju6aaw0yl1jzs Edvcpnaipk3audqab3pdafsq7/jv+R4ON9UFXJSWBUHO28FV4TBLNP/ddzy6+WNWOHMYWMTYMIK9QCKS3HW2FM6RF6XELTI0YQJRVHY0C34UALTG9KSY6XXHJL9VFBAOGBAOA9ZBONDON9A60OW2HZQGE59RZBYU9S7L728UANLFQROVBL Cnrvstzltqisv1ctggofolkvqavrt86ylwsmmq81waysjz5/5tde1fswuxjhj+YHUCTHHOBOPIE5FHR614CNB78SDWVNN1WF/Frfxqjossupoyjstbfbfzw8autraogbambdarcrid9yrz+zsk5ut5gxjyzt/fpzdcpwutrwgwhudt+Ptatjhicq9owp41rrlk15c5hx8d2m7nxpjpf0lqp7klud3qsepoxlrlyaxdgakpqjkf01nu5rnk7z3pus616qthhyum/oojcmzyhpwib86tfzf42unavqeqmtu0ihaogagsb1wbabbf6wcdxitnv+3GOGH6RNTLUQBBJFMJN/6VEF4OTJQNKNUCTGI5KVV539TA6OD8VXLM4NIPG80Y1VSAQDH03ZDWOZDLV/tkcqk5e4p3yimp/e3k4ipvpg31/zgv10k/5zowdgxwhrhtw4xqxq8udofoqisl5ddc0q20ccgya9tozty8zbyg0swqkxvnhexykggmzoa73yr6ardmqnecjr0fwddssika+nrdqzdmcdg8mbuafy17s9x/XPPLE75PYLWAUFG3XQ2V9ZBW8APKX7RSEPFDRGTM69KFWCT7LQGHRKNZPKFCNULTG90L7WHIOX2AMFGCVBSBFWDWAZGQKBGCNS9WU81O67RNE18YMCJZM OGBCV1US1SXAWQ7ZJZWAC5OF8717TQB+lzsgpkb8askqivbp3qkyognn51/wk6fsfe2jkvqfhcgrvcs7f1ofru3wey38qmz0yxz5hbi0g/g+iczsqwtuntjw2vcuwwwv4jakpqkogulcjvdijo/L6-----END RSA PRIVATE KEY-----[email protected] keys]# LSWWW.APP01.COM.CRT Www.app01.com.key www.app02.com.crt WWW.APP02.COM.KEYWWW.APP01.COM.CSR Www.app01.com.pem WWW.APP02.COM.CSR Www.app02.com.pem

[Email protected] haproxy-1.4. -]# Cat conf/haproxy.cfgGlobalLog127.0.0.1local0 Info Maxconn51200User Nobody group nobody daemon Nbproc1Pidfile/var/run/haproxy.piddefaults LogGlobaloption tcplog option httpclose option forwardfor except127.0.0.0/8option redispatch option Dontlognull retries3Timeout Client 1m Timeout Server 1m timeout http-Request 10s Timeout http-keep-Alive 10s Timeout queue 1m maxconn10000Listen admin_stats bind0.0.0.0:8000stats refresh 30s stats Uri/vip Stats Realm Hello Chenlin stats auth admin:[email protected]!Stats Hide-Version Stats adminifTRUE mode http #server sshd192.168.1.104: ACheck Port AInter theFall5frontend www.app01.com mode http bind0.0.0.0:443SSL Crt/etc/ssl/keys/www.app01.com.pem crt/etc/ssl/keys/Www.app02.com.pem use_backend www_app01_comif{Ssl_fc_sni www.app01.com} use_backend www_app02_comif{ssl_fc_sni www.app02.com}backend www_app01_com mode http Server app01192.168.1.108:8010Backend www_app02_com mode HTTP server app02192.168.1.109:8020

Haproxy implementation of multi-domain HTTPS

[Email protected] haproxy-1.5. 2] #./sbin/haproxy-VHA1.5/2013 Willy Tarreau <[email protected]>

Haproxy implementing Multi-Domain certificate HTTPS