I get the following error when attempting to access the https frontend url. I have not been able to pin down the configuration needed to resolve this issue:
Can’t connect securely to this page
This might be because the site uses outdated or unsafe TLS security settings. If this keeps happening, try contacting the website’s owner.
I have tried adding ssl force-tlsv* but still get the error. Any suggestions would be greatly appreciated.
( listen https_in :8443 ssl force-tlsv*)
Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.7
Compression algorithms supported : identity, deflate, gzip
Built with OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017
Running on OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.32 2012-11-30
PCRE library supports JIT : no (USE_PCRE_JIT not set)
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND
Available polling systems :
epoll : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.
Thanks lukastribus, please bear with me I am new to HaProxy. I want the frontend to serve as a load balancer to the backend servers. To be honest I have no preference between SSL passthrough or termination. I just need to be able to access the https frontend. Could you explain what’s wrong with the configuration?
Thanks
You not using SSL on the frontend (and they old-style listen configuration doesn’t even permit that), but you are specifying SSL on the server lines, so what you are doing is you are encrypting an already encrypted payload.
Ok, then lets keep it simple, and use SSL passthrough:
Drop everything ssl and http related (you cannot add/set HTTP headers if you are only passing encrypted payload back and forth).
And let’s use a frontend/backend approach, not the old style listen configuration, it’s only a little longer and will probably be helpful later on:
What error? Outdated or unsafe TLS security settings? Other than the specific browser refusing the connection, does SSL work? What is the output of curl -vv https://... against haproxy?
Haproxy is not doing anything SSL/TLS related. You are transparently passing TCP packets back and forth, in this configuration, so if Outdated/unsafe TLS warning are the only problem, then you need to fix the backend servers (or intercept TLS instead of passing it through).
The results of the curl -vv against haproxy
*** Initializing NSS with certpath: sql:/etc/pki/nssdb**
*** CAfile: /etc/pki/tls/certs/ca-bundle.crt**
** CApath: none**
*** NSS error -12263 (SSL_ERROR_RX_RECORD_TOO_LONG)**
*** SSL received a record that exceeded the maximum permissible length.**
*** Closing connection 0**
I’m researching the curl error… what parameter would I need to use intercept TLS?
Well clearly SSL doesn’t work. SSL_ERROR_RX_RECORD_TOO_LONG means that you are not really connecting to a serrvice that responds with proper SSL, and that’s also the reason for the unsafe messages in the browser.
What does curl -vv https:// against the backend server on port 8443 show, without haproxy in the mix?
Server names and related info has been removed. So, it looks like a certificate issue. Is there a parameter that will allow an insecure https connection?
I have stats enabled, didn’t think it was pertinent to share that section of the configuration for this issue. I have the output from the haproxy-access.log. Disclaimer, I have no experience with setting up proxy servers and I am not very knowledgeable when it comes to ssl. The Configuration manual (I have version 1.5.18 installed on RHEL 7.5) often leads to more questions than answers. Just let me know if you’re looking for something else from the log.