# HAproxy ssl offload for Redis

**URL:** <https://discourse.haproxy.org/t/haproxy-ssl-offload-for-redis/6908>\
**Category:** Help!\
**Created:** [September 14, 2021, 9:46pm UTC](https://discourse.haproxy.org/t/haproxy-ssl-offload-for-redis/6908 "2021-09-14T21:46:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![radaeld](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@radaeld](https://discourse.haproxy.org/u/radaeld)\
**Post date:** [September 14, 2021, 9:46pm UTC](https://discourse.haproxy.org/t/haproxy-ssl-offload-for-redis/6908/1 "2021-09-14T21:46:24Z")

</div>

Hey Guys,  
Im trying to configure HAproxy ssl offload for Redis. In other words, have the ssl termination on the HAproxy. However, im not being able to achieve this and need some help.

For the certificates im using Vault PKI Engine to generate selfsign certificates with an Intermediate CA.  
I tried compacting all in one file, ca certificate + intermediate + cert but still fails.

If i try to connect via `redis-cli` without specifying the `--tls` flag it connects but then when i try to run commands i just receive the following error:  
`Error: Server closed the connection`

If i specify `--tls` flag i get `SSL_connect failed: certificate verify failed`

Not sure why but it does not show anything in the logs.

If anyone could help me i would appreciate.

Everything is running with docker. HAproxy is using tag 2.3  
The HAproxy config file is the following:

```auto
defaults REDIS 
    mode tcp  
    timeout connect 3s  
    timeout server 3s  
    timeout client 3s 

frontend ft_redis 
    mode tcp 
    bind *:6380 ssl crt /usr/local/etc/haproxy/ha.pem ca-file /usr/local/etc/haproxy/ca.crt crl-file /usr/local/etc/haproxy/crl.pem  
    default_backend bk_redis 
  
backend bk_redis 
    mode tcp 
    option tcp-check 
    tcp-check send AUTH\ root\r\n 
    tcp-check expect string +OK 
    tcp-check send PING\r\n 
    tcp-check expect string +PONG 
    tcp-check send info\ replication\r\n 
    tcp-check expect string role:master 
    tcp-check send QUIT\r\n 
    tcp-check expect string +OK 
    server redis_node1 redis-master:6379 maxconn 4096 check inter 3s 
    server redis_node2 redis-replication_redis-replica_1:6379 maxconn 4096 check inter 3s
    server redis_node3 redis-replication_redis-replica_2:6379 maxconn 4096 check inter 3s

```

---

<div class="post-metadata">

**Author:** ![Rfraile](https://avatars.discourse-cdn.com/v4/letter/r/50afbb/32.png) [@Rfraile](https://discourse.haproxy.org/u/Rfraile)\
**Post date:** [September 17, 2021, 3:20pm UTC](https://discourse.haproxy.org/t/haproxy-ssl-offload-for-redis/6908/2 "2021-09-17T15:20:19Z")

</div>

Try combine SSL Passthrough with session sticky based on src at the frontend.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [September 19, 2021, 5:52pm UTC](https://discourse.haproxy.org/t/haproxy-ssl-offload-for-redis/6908/3 "2021-09-19T17:52:09Z")

</div>

> [@radaeld](#):
>
> For the certificates im using Vault PKI Engine to generate selfsign certificates with an Intermediate CA.  
> I tried compacting all in one file, ca certificate + intermediate + cert but still fails.
> 
> If i try to connect via `redis-cli` without specifying the `--tls` flag it connects but then when i try to run commands i just receive the following error:  
> `Error: Server closed the connection`
> 
> If i specify `--tls` flag i get `SSL_connect failed: certificate verify failed`

Seems like a straightforward certificate issue. Either you get a proper certificate (not selfsigned), or you instruct redis-cli to not do certificate verification (you will have to consult redis-cli documentation).