Slime: Haproxy Learning HTTPS configuration

in the previous period, I wrote several articles about learning Haproxy. Today we will introduce the next haproxy HTTPS configuration, the benefits of the HTTPS protocol here, we do not introduce.

we only describe how to configure HTTPS, and how HTTPS is used in a real-world production environment.

PS: This experiment is all tested in the haproxy1.5.4 version. haproxy1.3 version The following haproxy configuration parameters may not be used, you need to note the version number.

The following haproxy configurations are used directly on the online production environment.

first, business requirements

now, according to the actual needs of the business, there are several different needs. as follows:

1.1 http jump HTTPS

jump all requests http://http.ilanni.com addresses to https//:http.ilanni.com this address.

1.2 http and HTTPS coexist

The server also opens http://http.ilanni.com and https://http.ilanni.com access forms.

1.3 HTTPS and http between different domain names on the same server

The same server to the http.ilanni.com domain access to the full jump to https://http.ilanni.com, while the haproxy.ilanni.com access to the HTTP protocol, that is, jump to HTTP.// Haproxy.ilanni.com this address.

1.4 use HTTPS for multiple domain names on the same server

the same server to http.ilanni.com and haproxy.ilanni.com access to go HTTP is the protocol.

Ii. Configuring Haproxy and testing business requirements

Now we have to configure haproxy one by one to meet the needs of our business.

2.1 http jump HTTPS configuration

to tell the truth haproxy HTTPS configuration is much simpler than nginx configuration, we only need to add a few lines of code to achieve the function of HTTPS.

http Jump HTTPS haproxy configuration file content, as follows:

Global

log 127.0.0.1 local0

log 127.0.0.1 local1 notice

maxconn 4096

UID 188

GID 188

Daemon

Tune.ssl.default-dh-param 2048

Defaults

Log Global

Mode HTTP

option Httplog

option Dontlognull

option Http-server-close

option forwardfor except 127.0.0.1

option Redispatch

Retries 3

option Redispatch

Maxconn

Timeout Http-request 10s

Timeout Queue 1m

Timeout Connect 10s

Timeout Client 1m

Timeout Server 1m

Timeout Http-keep-alive 10s

Timeout Check 10s

Maxconn

Listen Admin_stats

bind 0.0.0.0:1080

Mode HTTP

option Httplog

Maxconn Ten

Stats Refresh 30s

Stats Uri/stats

Stats Auth Admin:admin

Stats hide-version

frontend weblb

bind *:80

ACL is_http Hdr_beg (host) http.ilanni.com

REDIRECT Scheme https if! {SSL_FC}

bind *:443 SSL Crt/etc/haproxy/ilanni.com.pem

use_backend httpserver if Is_http

Backend Httpserver

Balance Source

server Web1 127.0.0.1:7070 maxconn 1024x768 weight 3 check Inter rise 2 Fall 3

In the above configuration file, you need to be aware of the following options:

Tune.ssl.default-dh-param 2048 Because our SSL key uses 2048bit encryption, we declare it here.

ACL is_http Hdr_beg (host) http.ilanni.com

REDIRECT Scheme https if! {SSL_FC}

bind *:443 SSL Crt/etc/haproxy/ilanni.com.pem

these three lines indicate that all requests to access http.ilanni.com This domain name are forwarded to https://http.ilanni.com for this connection.

2.2 test http jump https

after HTTP jump HTTPS configuration is complete, we choose to test its jump. as follows:

you will find that in the browser, whether you enter http.ilanni.com, or http://http.ilanni.com or https://http.ilanni.com, it will automatically jump to https://http.ilanni.com.

This is achieved by forwarding all HTTP requests to HTTPS for the purpose.

2.3 http and HTTPS coexistence configuration

Haproxy to implement the coexistence of HTTP and HTTPS, configuration is also very simple, only need to separate the Haproxy to monitor the different ports on the line, the configuration file is as follows:

Global

log 127.0.0.1 local0

log 127.0.0.1 local1 notice

maxconn 4096

User Haproxy

Group Haproxy

Daemon

Tune.ssl.default-dh-param 2048

Defaults

Log Global

Mode HTTP

option Httplog

option Dontlognull

Retries 3

option Redispatch

Maxconn

Timeout Connect 5000ms

Timeout Client 50000ms

Timeout Server 50000ms

Listen Admin_stats

bind 0.0.0.0:1080

Mode HTTP

option Httplog

Maxconn Ten

Stats Refresh 30s

Stats Uri/stats

Stats Auth Admin:admin

Stats hide-version

frontend weblb

bind *:80

ACL is_http Hdr_beg (host) http.ilanni.com

use_backend httpserver if Is_http

Backend Httpserver

Balance Source

server Web1 127.0.0.1:7070 maxconn 1024x768 weight 3 check Inter rise 2 Fall 3

frontend weblb443

bind *:443 SSL Crt/etc/haproxy/ilanni.com.pem

ACL is_443 Hdr_beg (host) http.ilanni.com

use_backend httpserver443 if is_443

Backend httpserver443

Balance Source

server Web1 127.0.0.1:7070 maxconn 1024x768 weight 3 check Inter rise 2 Fall 3

In the above configuration file, we defined two front-end, one front-end for listening to 80 ports, which is the HTTP protocol. Another front-end listens on port 443, which is the HTTPS protocol.

at this point, the haproxy is distributed according to the Protocol requested by the client, and if the client requests an HTTP protocol, the request is distributed to the front of the listening 80 port. If the client is found to be requesting an HTTPS protocol, the request is distributed to the front end of the listening 443 port. This achieves the requirement that the Haproxy let HTTP and HTTPS coexist.

2.4 test http and HTTPS coexistence

once the HTTP and HTTPS configurations are complete, we choose to test their jumps. as follows:

by testing you will find that in the browser if you enter the http://http.ilanni.com or http.ilanni.com will jump directly to http://http.ilanni.com, and the input is https:// Http.ilanni.com, it will only jump to https://http.ilanni.com.

so it arrives, the requirements of our business to achieve the coexistence of HTTP and HTTPS.

2.5 HTTPS and HTTP configuration between different domain names on the same server

the HTTP and HTTPS configuration between different domain names of the same server is more complex, the first need to listen to two ports, the second to be distributed according to different domain names.

The haproxy configuration file is as follows:

Global

log 127.0.0.1 local0

log 127.0.0.1 local1 notice

maxconn 4096

UID 188

GID 188

Daemon

Tune.ssl.default-dh-param 2048

Defaults

Log Global

Mode HTTP

option Httplog

option Dontlognull

option Http-server-close

option forwardfor except 127.0.0.1

option Redispatch

Retries 3

option Redispatch

Maxconn

Timeout Http-request 10s

Timeout Queue 1m

Timeout Connect 10s

Timeout Client 1m

Timeout Server 1m

Timeout Http-keep-alive 10s

Timeout Check 10s

Maxconn

Listen Admin_stats

bind 0.0.0.0:1080

Mode HTTP

option Httplog

Maxconn Ten

Stats Refresh 30s

Stats Uri/stats

Stats Auth Admin:admin

Stats hide-version

frontend weblb

bind *:80

ACL is_haproxy Hdr_beg (host) haproxy.ilanni.com

ACL is_http Hdr_beg (host) http.ilanni.com

REDIRECT Prefix https://http.ilanni.com if is_http

use_backend haproxyserver if Is_haproxy

Backend Haproxyserver

Balance Source

server Web1 127.0.0.1:9090 maxconn 1024x768 weight 3 check Inter rise 2 Fall 3

frontend weblb443

bind *:443 SSL Crt/etc/haproxy/ilanni.com.pem

ACL is_443 Hdr_beg (host) http.ilanni.com

use_backend httpserver443 if is_443

Backend httpserver443

Balance Source

server Web1 127.0.0.1:7070 maxconn 1024x768 weight 3 check Inter rise 2 Fall 3

HTTPS and HTTP configuration between different domain names of the same server, we configured two front-end one for listening to 80 ports and jumping according to different domain names. In the 80-port rule, if the client is requesting http.ilanni.com, the domain name, then Haproxy will jump directly to https://http.ilanni.com. If it is haproxy.ilanni.com, the domain name is distributed to the backend server.

Another front-end is used to listen on port 443 for distributing client https://http.ilanni.com requests.

2.6 testing HTTPS and HTTP configuration between different domain names of the same server

after configuring HTTPS and HTTP configuration between different domain names on the same server, we will now test. as follows:

through, we can find in the browser input haproxy.ilanni.com will jump to http://haproxy.ilanni.com this address, and if the input is http.ilanni.com or HTTP/ Http.ilanni.com, or https://http.ilanni.com words, will jump to https://http.ilanni.com.

this has reached our business requirements, the same server access haproxy.ilanni.com directly to 80 port, if the access is http.ilanni.com domain name, then jump to https://http.ilanni.com this address.

2.7 use HTTPS configuration for multiple domain names on the same server

to make the same server two settings multiple domain names are using the HTTPS protocol, the configuration is simple. You only need to enable the respective HTTPS configuration in Haproxy.

haproxy configuration file, as follows:

Global

log 127.0.0.1 local0

log 127.0.0.1 local1 notice

maxconn 4096

UID 108

GID

Daemon

Tune.ssl.default-dh-param 2048

Defaults

Log Global

Mode HTTP

option Httplog

option Dontlognull

option Http-server-close

option forwardfor except 127.0.0.1

option Redispatch

Retries 3

option Redispatch

Timeout Http-request 10s

Timeout Queue 1m

Timeout Connect 10s

Timeout Client 1m

Timeout Server 1m

Timeout Http-keep-alive 10s

Timeout Check 10s

Maxconn

Listen Admin_stats

bind 0.0.0.0:1080

Mode HTTP

option Httplog

Maxconn Ten

Stats Refresh 30s

Stats Uri/stats

Stats Auth Admin:admin

Stats hide-version

frontend web80

bind *:80

ACL is_http Hdr_beg (host) http.ilanni.com

REDIRECT Scheme https if! {SSL_FC}

bind *:443 SSL Crt/etc/haproxy/ilanni.com.pem

ACL is_haproxy Hdr_beg (host) haproxy.ilanni.com

REDIRECT Scheme https if! {SSL_FC}

bind *:443 SSL Crt/etc/haproxy/ilanni.com.pem

use_backend httpserver if Is_http

use_backend haproxyserver if Is_haproxy

Backend Httpserver

Balance Source

server Web1 127.0.0.1:6060 maxconn 1024x768 weight 3 check Inter rise 2 Fall 3

Backend Haproxyserver

Balance Source

server Web1 127.0.0.1:9090 maxconn 1024x768 weight 3 check Inter rise 2 Fall 3

The configuration file is relatively simple, so there is no further explanation here.

2.8 Testing the same server multi-domain uses HTTPS

The same server multiple domain names are used HTTPS, after configuration is complete, now we come to test.

through, we can see in the browse whether the input http.ilanni.com, http://http.ilanni.com, or haproxy.ilanni.com, HTTP/ Haproxy.ilanni.com, it will jump to the corresponding HTTPS address.

This also meets the requirements of our business.

Slime: Haproxy Learning HTTPS configuration