Hi All,
We have HAproxy running perfectly until there is a need to add 2 services that use SSL, calling web1 and web2. We have installed a wild-child SSL certificate in te server.
maxconn 500
# Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
# Default ciphers to use on SSL-enabled listening sockets.
# For more information, see ciphers(1SSL). This list is from:
# https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
ssl-default-bind-ciphers ECDHE-RSA-AES256-GCM -HA384:ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
tune.ssl.default-dh-param 4096
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11
acl web1 hdr(host) -i abc1.abc.com
use_backend web1b if web1
acl web2 hdr(host) -i abc2.abc.com
use_backend web2b if web2
option forwardfor
default_backend www
backend www
mode http
server ipx x.x.x.x:80 check maxconn 500
backend web1b
mode http
server ipx1 y.y.y.y.y:80 check maxconn 500
backend web2b
mode http
server ipx2 z.z.z.z:80 check maxconn 500
After making some tests we are in this situation :
abc2.abc.com is routed into the backend www
-If we remove the default_bakcend the abc2.abc.com can not be served and we have this errors :
-1/-1/-1/-1/0 503 212 - - SC–
In all the tests above we confirmed that abc1.abc.com is served ok in both situations.
Can everyone help us please to dig more in order we can solve this situation?
Thanks in advance
SC The server or an equipment between it and HAProxy explicitly refused
the TCP connection (the proxy received a TCP RST or an ICMP message
in return). Under some circumstances, it can also be the network
stack telling the proxy that the server is unreachable (e.g. no route,
or no ARP response on local network). When this happens in HTTP mode,
the status code is likely a 502 or 503 here.
It sounds like HAProxy cannot reach the backend servers. When you start the HAProxy service, the logs should show if the server is up or down, something like:
Feb 9 21:12:32 --hostname-- haproxy[--pid--]: [WARNING] (--pid--) : Server web1b/ipx1 is DOWN, reason: Layer4 timeout, check duration: 2001ms. 2 active and 0 backup servers left. 1 sessions active, 0 requeued, 0 remaining in queue.
Feb 9 21:12:32 --hostname-- haproxy[--pid--]: Server web1b/ipx1 is DOWN, reason: Layer4 timeout, check duration: 2001ms. 2 active and 0 backup servers left. 1 sessions active, 0 requeued, 0 remaining in queue.
OR
Feb 9 21:12:34 --hostname-- haproxy[--pid--]: [WARNING] (--pid--) : Server web1b/ipx1 is UP, reason: Layer7 check passed, code: 0, check duration: 0ms. 3 active and 0 backup servers online. 0 sessions requeued, 0 total in queue.
Feb 9 21:12:34 --hostname-- haproxy[--pid--]: Server web1b/ipx1 is UP, reason: Layer7 check passed, code: 0, check duration: 0ms. 3 active and 0 backup servers online. 0 sessions requeued, 0 total in queue.
Hi Stormover,
Many thanks for your fast reply. In this installation, we have running some other running services so we will make some tests in some other test instance and will come back with feedback.
Best regards