Hi there,
I am having trouble to configure Haproxy encrypted connection to my home camera which uses 2 ports:
- Port 8092: which is the login page and uses a weak encryption TLS 1.0 [ TLS_DHE_RSA_WITH_AES_128_CBC_SHA, 128 bit keys, TLS 1.0 ] (Can’t make it work)
- Port 8080: which is the video stream and is not encrypted. (I successfuly added TLS 1.3 encryption)
My idea was to:
- Frontend: encrypt trafic from Clients to servers configuring my Own ssl encryption (TLS 1.3) on haproxy with own certificates.
- Backend: divide the backend into two, one for the encripted port 8092 (TLS 1.0) and the other to the non encripted port 8080.
The problem is with port 8092 which by some reason can not start when I add the “ssl” keyword on the back-end as shown below and if no ssl keyword, it doesn’t work since the backend camera server as said before has TLS 1.0.
frontend tplink_in_8092
bind-process 2-3
bind *:8092 tfo ssl crt /etc/ssl/certs_self/prime256v1.pem process 2 alpn h2,http/1.1 curves X25519:P-256:secp384r1
bind abns@haproxy-clt5 accept-proxy tfo ssl crt /etc/ssl/certs_self/ec_concatenated_prime256v1.pem process 3 alpn h2,http/1.1 curves X25519:P-256:secp384r1
mode http
option forwardfor
http-request redirect scheme https code 301 if !{ ssl_fc }
http-request redirect scheme https if !{ ssl_fc }
http-request add-header X-Forwarded-Proto https
http-response set-header X-Frame-Options: DENY
http-response set-header X-Content-Type-Options: nosnif
http-response set-header Strict-Transport-Security max-age=31536000;includeSubDomains;preload
http-response set-header X-XSS-Protection: 1;mode=block
http-response set-header Referrer-Policy no-referrer-when-downgrade
# HSTS (15768000 seconds = 6 months)
http-response set-header Strict-Transport-Security max-age=15768000
default_backend tplink_dest_8092backend tplink_dest_8092
mode http
option forwardfor
option http-server-close
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
# server ipcam 192.168.0.155:8092 force-tlsv10 check verify none (Doesn’t work but haproxy can start)
# server ipcam 192.168.0.155:8092 force-tlsv10 ssl ca-file /etc/ssl/certs/ca-certificates.crt check ssl verify none (Haproxy doesn’t start)
# server ipcam 192.168.0.155:8092 force-tlsv10 ssl ca-file /etc/ssl/certs/ca-certificates.crt check ssl verify none (Haproxy doesn’t start)
The error shown in the log when Haproxy doesn’t start is:
Aug 7 23:17:34 raspberrypi haproxy[18707]: [ALERT] 218/231734 (18707) : Proxy ‘tplink_dest_8092’, server ‘ipcam’ [/etc/haproxy/haproxy.cfg:146] : unable to set TLS 1.3 cipher suites to ‘TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384’.
Aug 7 23:17:34 raspberrypi haproxy[18707]: [ALERT] 218/231734 (18707) : Fatal errors found in configuration.
My SSL configuration under global is:
# Default SSL material locations ca-base /etc/ssl/certs_self crt-base /etc/ssl/private #SSL/TLS Mode async #ssl-engine rdrand ssl-mode-async #Increase TLS session cache size and lifetime to avoid computing too many symetric keys tune.ssl.cachesize 100000 tune.ssl.lifetime 600 tune.ssl.maxrecord 1460 #Due to Raspberry pid doesn't have AES hardware crypto we prefer chacha20 #TLS1.2 ssl-default-bind-ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ssl-default-server-ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 #TLS1.3 ssl-default-bind-ciphersuites TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384 ssl-default-server-ciphersuites TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384 #ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets ssl-default-bind-options ssl-min-ver TLSv1.0 no-tls-tickets
where I changed from “ssl-min-ver TLSv1.2” to “ssl-min-ver TLSv1.0” expecting it to work but unfortunately it doesn’t. Not even if adding “force-tlsv10” to the backend as shown above in the backend configuration. 
And here is my “haproxy -vv” for reference:
HA-Proxy version 1.8.19-1+rpi1 2019/03/14
Copyright 2000-2019 Willy Tarreau willy@haproxy.orgBuild options :
TARGET = linux2628
CPU = generic
CC = gcc
CFLAGS = -O2 -g -O2 -fdebug-prefix-map=/haproxy-1.8.19=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fno-strict-aliasing -Wdeclaration-after-statement -fwrapv -Wno-format-truncation -Wno-null-dereference -Wno-unused-label
OPTIONS = USE_GETADDRINFO=1 USE_ZLIB=1 USE_OPENSSL=1 USE_LUA=1 USE_SYSTEMD=1 USE_PCRE2=1 USE_PCRE2_JIT=1 USE_NS=1Default settings :
maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200Built with OpenSSL version : OpenSSL 1.1.1b 26 Feb 2019
Running on OpenSSL version : OpenSSL 1.1.1c 28 May 2019
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3
Built with Lua version : Lua 5.3.3
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND
Encrypted password support via crypt(3): yes
Built with multi-threading support.
Built with PCRE2 version : 10.32 2018-09-10
PCRE2 library supports JIT : yes
Built with zlib version : 1.2.11
Running on zlib version : 1.2.11
Compression algorithms supported : identity(“identity”), deflate(“deflate”), raw-deflate(“deflate”), gzip(“gzip”)
Built with network namespace support.Available polling systems :
epoll : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.Available filters :
[SPOE] spoe
[COMP] compression
[TRACE] trace
Please if you have some advice or note from where to adjust.
Thank you:grinning:
