# Ha proxy as reverse proxy as WA for tlsv1.2-\>tlsv1

**URL:** <https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-as-wa-for-tlsv1-2-tlsv1/4717>\
**Category:** Help!\
**Created:** [January 13, 2020, 1:39pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-as-wa-for-tlsv1-2-tlsv1/4717 "2020-01-13T13:39:08Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![yuriy.tigiev](https://avatars.discourse-cdn.com/v4/letter/y/b5a626/32.png) [@yuriy.tigiev](https://discourse.haproxy.org/u/yuriy.tigiev)\
**Post date:** [January 13, 2020, 1:39pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-as-wa-for-tlsv1-2-tlsv1/4717/1 "2020-01-13T13:39:08Z")

</div>

Hello,

I’m looking for a haproxy configuration which will allow me to implement the scheme bellow.

**client** --(https tlsv1.2)–\> **haproxy** --(https tlsv1)–\> **legacy server**

The current configuration doesn’t work. I hope someone will help me update it for my requirements.

global  
log 127.0.0.1 local2  
tune.ssl.default-dh-param 2048

defaults  
log global  
option httplog

```
timeout connect 10s
timeout client 30s
timeout server 30s
maxconn 1000

```

frontend https-frontend  
mode http  
option forwardfor  
bind \*:8899 ssl crt /root/cert/rootcert.pem  
default\_backend https-backend

backend https-backend  
balance source  
mode http  
option forwardfor header X-Client  
server endpoint 172.30.129.207:8443 check ssl verify none

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [January 13, 2020, 1:44pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-as-wa-for-tlsv1-2-tlsv1/4717/2 "2020-01-13T13:44:31Z")

</div>

As per your issue report and my response:

> <https://github.com/haproxy/haproxy/issues/444#issuecomment-573657323>
>
> Hello,
> haproxy returns an error fd\[0009\] OpenSSL error\[0x1407609b\] SSL23\_GET\_CLIENT\_HELLO: https proxy request on any curl request. Please, help me solve the issue.
> Scheme...

You are using the wrong curl call.

`curl --verbose --insecure --proxy localhost:8899 -X GET 'https://www.google.com:8443'`

This is wrong, because haproxy is not a forwarding, but a reverse proxy.

This is what your request needs to look like:  
`curl --verbose --insecure 'https://localhost:8899'`

---

<div class="post-metadata">

**Author:** ![yuriy.tigiev](https://avatars.discourse-cdn.com/v4/letter/y/b5a626/32.png) [@yuriy.tigiev](https://discourse.haproxy.org/u/yuriy.tigiev)\
**Post date:** [January 13, 2020, 3:34pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-as-wa-for-tlsv1-2-tlsv1/4717/3 "2020-01-13T15:34:56Z")

</div>

The site [https://www.google.com:8443](https://www.google.com:8443) was provided as example. In the real configuration, I used the internal sever - server1.local

The curl call works properly if I use http protocol  
curl --verbose --insecure --proxy localhost:8899 -X GET ‘[http://internal.server:8443](http://internal.server:8443)’  
and in configuration I have  
`bind *:8899`  
and doesn’t work for  
`bind *:8899 ssl crt /root/cert/rootcert.pem`

I can’t understand why. The issue happens if I use https and bind crt on the front end side.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [January 13, 2020, 4:09pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-as-wa-for-tlsv1-2-tlsv1/4717/4 "2020-01-13T16:09:38Z")

</div>

`--proxy localhost:8899` means a _forward_ proxy without SSL at port 8899 on localhost; you’d have to use `--proxy https://localhost:8899` to use SSL. That’s the reason the behavior changes when your drop the SSL keyword from port 8899 in the haproxy configuration.

You can find more about this in the curl manpage:

[https://curl.haxx.se/docs/manpage.html#-x](https://curl.haxx.se/docs/manpage.html#-x)

However it is important to understand that this is NOT what you are supposed to use haproxy for. Haproxy is a reverse proxy and you SHOULD NOT be using the `--proxy` command in curl AT ALL.

I’m not exactly sure what you are trying to achieve here, but either your are just testing it wrong with curl, you are have the wrong expectation of what haproxy will do for you in the first place.

---

<div class="post-metadata">

**Author:** ![yuriy.tigiev](https://avatars.discourse-cdn.com/v4/letter/y/b5a626/32.png) [@yuriy.tigiev](https://discourse.haproxy.org/u/yuriy.tigiev)\
**Post date:** [January 13, 2020, 6:33pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-as-wa-for-tlsv1-2-tlsv1/4717/5 "2020-01-13T18:33:45Z")

</div>

@lukastribus

You are right. I should not use the --proxy with curl for testing. Thank you for your support.

Could you give a suggestion how to configure a reverse proxy? Is configuration which I provided correct for scenario (client api) – (tls 1.2) --\> (reverse proxy) – (tls 1) --\> (legacy web service api)

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [January 13, 2020, 7:43pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-as-wa-for-tlsv1-2-tlsv1/4717/6 "2020-01-13T19:43:15Z")

</div>

Yes, the configuration is correct.

It could be that your backend server requires additional things though. For example, it could be possible that your server expects a certain Host header and maybe even SNI in the SSL handshake (however the latter is rather unlikely if we are talking about an old TLSv1.0 backend).

To rewrite the Host header you can do something like this in the backend:

```
http-request set-header Host api.example.org

```

To set the SNI value you need to add it to the server line:

```
server endpoint 172.30.129.207:8443 check ssl verify none sni str(api.example.org)
```

---

<div class="post-metadata">

**Author:** ![yuriy.tigiev](https://avatars.discourse-cdn.com/v4/letter/y/b5a626/32.png) [@yuriy.tigiev](https://discourse.haproxy.org/u/yuriy.tigiev)\
**Post date:** [January 14, 2020, 9:12am UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-as-wa-for-tlsv1-2-tlsv1/4717/7 "2020-01-14T09:12:54Z")

</div>

@lukastribus

Thank you for your support. Everything works properly as required.

Which the latest version of haproxy supports tlsv1.0 - tlsv1.3?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [January 14, 2020, 9:52am UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-as-wa-for-tlsv1-2-tlsv1/4717/8 "2020-01-14T09:52:33Z")

</div>

That depends on the OpenSSL version haproxy is linked against. Only OpenSSL 1.1.1 supports TLSv1.3.