Haproxy SSL Configuration

There are two methods for haproxy proxy SSL

1. haproxy itself provides an SSL certificate, and the subsequent web server follows the normal HTTP

2. haproxy itself only provides proxy, followed by the Web server https

Method 1

You need to compile haproxy to support SSL. Compile parameters:

make TARGET=linux26 USE_OPENSSL=1 ADDLIB=-lzldd haproxy | grep ssllibssl.so.10 => /usr/lib64/libssl.so.10 (0x00007fb0485e5000)

Configuration parameters:

Frontend https_frontend bind *: 443 ssl crt/etc/SSL/certs/servername. PEM mode HTTP option httpclose option forwardfor reqadd X-forwarded-Proto: \ HTTPS secure web_serverbackend web_server mode HTTP balance roundrobin cookie serverid insert indirect nocache server S1 192.168.250.47: 80 check cookie S1 server S2 192.168.250.49: 80 check cookie S2 Note: The PEM file is merged into the following two files: CAT servername. CRT servername. key | tee servername. PEM

Method 2

It is simple and convenient to recompile and support SSL. You only need to configure SSL for the Web server.

Frontend https_frontend bind *: 443 mode TCP default_backend web_serverbackend web_server mode TCP balance roundrobin stick-Table type IP size 200 K expire 30 m stick on SRC server S1 192.168.250.47: 443 server S2 192.168.250.49: 443 note: In this mode, the mode must be TCP.

Refer:

Http://virtuallyhyper.com/2013/05/configure-haproxy-to-load-balance-sites-with-ssl/

Http://www.rackspace.com/knowledge_center/article/setting-up-haproxy