Hi Lukastribus,
Thanks again for your response.
Again my apologies for not being clear.
The below TCP (SSL Passthrough) config works fine when the applications are accessed from browser example: https://app1.example.com .
The application also has REST api calls which are failing with error SSL handshake error with this TCP mode config.
I am assuming the application API calls are failing due to TCP mode ie. expecting SSL in Haproxy. How would I configure the same using https using the wildcard certificates (as mentioned before) or is there an option to fix this SSL handshake error with TCP config ?
########################################
HA-Proxy version 2.1.4-1ppa1~bionic 2020/04/12 - https://haproxy.org/
Status: stable branch - will stop receiving fixes around Q1 2021.
Known bugs: http://www.haproxy.org/bugs/bugs-2.1.4.html
Build options :
TARGET = linux-glibc
CPU = generic
CC = gcc
CFLAGS = -O2 -g -O2 -fdebug-prefix-map=/build/haproxy-DKPuPX/haproxy-2.1.4=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fno-strict-aliasing -Wdeclaration-after-statement -fwrapv -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-old-style-declaration -Wno-ignored-qualifiers -Wno-clobbered -Wno-missing-field-initializers -Wno-implicit-fallthrough -Wno-stringop-overflow -Wtype-limits -Wshift-negative-value -Wshift-overflow=2 -Wduplicated-cond -Wnull-dereference
OPTIONS = USE_PCRE2=1 USE_PCRE2_JIT=1 USE_REGPARM=1 USE_OPENSSL=1 USE_LUA=1 USE_ZLIB=1 USE_SYSTEMD=1
Feature list : +EPOLL -KQUEUE -MY_EPOLL -MY_SPLICE +NETFILTER -PCRE -PCRE_JIT +PCRE2 +PCRE2_JIT +POLL -PRIVATE_CACHE +THREAD -PTHREAD_PSHARED +REGPARM -STATIC_PCRE -STATIC_PCRE2 +TPROXY +LINUX_TPROXY +LINUX_SPLICE +LIBCRYPT +CRYPT_H -VSYSCALL +GETADDRINFO +OPENSSL +LUA +FUTEX +ACCEPT4 -MY_ACCEPT4 +ZLIB -SLZ +CPU_AFFINITY +TFO +NS +DL +RT -DEVICEATLAS -51DEGREES -WURFL +SYSTEMD -OBSOLETE_LINKER +PRCTL +THREAD_DUMP -EVPORTS
Default settings :
bufsize = 16384, maxrewrite = 1024, maxpollevents = 200
Built with multi-threading support (MAX_THREADS=64, default=1).
Built with OpenSSL version : OpenSSL 1.1.1 11 Sep 2018
Running on OpenSSL version : OpenSSL 1.1.1 11 Sep 2018
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3
Built with Lua version : Lua 5.3.3
Built with network namespace support.
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND
Built with PCRE2 version : 10.31 2018-02-12
PCRE2 library supports JIT : yes
Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.11
Running on zlib version : 1.2.11
Compression algorithms supported : identity(“identity”), deflate(“deflate”), raw-deflate(“deflate”), gzip(“gzip”)
Built with the Prometheus exporter as a service
Available polling systems :
epoll : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.
Available multiplexer protocols :
(protocols marked as cannot be specified using ‘proto’ keyword)
h2 : mode=HTTP side=FE|BE mux=H2
fcgi : mode=HTTP side=BE mux=FCGI
<default> : mode=HTTP side=FE|BE mux=H1
<default> : mode=TCP side=FE|BE mux=PASS
Available services :
prometheus-exporter
Available filters :
[SPOE] spoe
[CACHE] cache
[FCGI] fcgi-app
[TRACE] trace
[COMP] compression
########################################
defaults
log global
mode tcp
option tcplog
option dontlognull
option log-health-checks
timeout connect 5000
timeout client 50000
timeout server 50000
frontend stats
bind *:8404
mode http
stats enable
stats uri /stats
stats refresh 10s
stats hide-version
frontend http_front
bind *:443
#bind *:443 ssl crt /etc/ssl/ppllc/example.com.pem
option tcplog
acl network_allowed src -f /etc/haproxy/acls/whitelisted_cidr.acl
tcp-request connection reject if !network_allowed
#acl tls req.ssl_hello_type 1
tcp-request inspect-delay 5s
#tcp-request content accept if tls
tcp-request content accept if { req_ssl_hello_type 1 }
acl host_app1 req.ssl_sni -i app1.example.com
acl host_app2 req.ssl_sni -i app2.example.com
acl host_app3 req.ssl_sni -i app3.example.com
use_backend be_app1 if host_app1
use_backend be_app2 if host_app2
use_backend be_app3 if host_app3
backend be_app1
balance source
# maximum SSL session ID length is 32 bytes.
stick-table type binary len 32 size 30k expire 30m
#stick-table type ip size 1m expire 1h
stick on src
acl clienthello req_ssl_hello_type 1
acl serverhello rep_ssl_hello_type 2
# use tcp content accepts to detects ssl client and server hello.
tcp-request inspect-delay 5s
tcp-request content accept if clienthello
# no timeout on response inspect delay by default.
tcp-response content accept if serverhello
# SSL session ID (SSLID) may be present on a client or server hello.
# Its length is coded on 1 byte at offset 43 and its value starts
# at offset 44.
# Match and learn on request if client hello.
stick on payload_lv(43,1) if clienthello
# Learn on response if server hello.
stick store-response payload_lv(43,1) if serverhello
option tcp-check
server serv1_8387 10.23.19.166:8387 check fall 3 rise 2
server serv2_8387 10.23.19.167:8387 check fall 3 rise 2
backend be_app2
balance source
# maximum SSL session ID length is 32 bytes.
stick-table type binary len 32 size 30k expire 30m
#stick-table type ip size 1m expire 1h
stick on src
acl clienthello req_ssl_hello_type 1
acl serverhello rep_ssl_hello_type 2
# use tcp content accepts to detects ssl client and server hello.
tcp-request inspect-delay 5s
tcp-request content accept if clienthello
# no timeout on response inspect delay by default.
tcp-response content accept if serverhello
# SSL session ID (SSLID) may be present on a client or server hello.
# Its length is coded on 1 byte at offset 43 and its value starts
# at offset 44.
# Match and learn on request if client hello.
stick on payload_lv(43,1) if clienthello
# Learn on response if server hello.
stick store-response payload_lv(43,1) if serverhello
option tcp-check
server serv3_8387 10.23.19.166:8400 check fall 3 rise 2
server serv4_8387 10.23.19.167:8400 check fall 3 rise 2
backend be_app3
balance source
# maximum SSL session ID length is 32 bytes.
stick-table type binary len 32 size 30k expire 30m
#stick-table type ip size 1m expire 1h
stick on src
acl clienthello req_ssl_hello_type 1
acl serverhello rep_ssl_hello_type 2
# use tcp content accepts to detects ssl client and server hello.
tcp-request inspect-delay 5s
tcp-request content accept if clienthello
# no timeout on response inspect delay by default.
tcp-response content accept if serverhello
# SSL session ID (SSLID) may be present on a client or server hello.
# Its length is coded on 1 byte at offset 43 and its value starts
# at offset 44.
# Match and learn on request if client hello.
stick on payload_lv(43,1) if clienthello
# Learn on response if server hello.
stick store-response payload_lv(43,1) if serverhello
option tcp-check
server serv1_8387 10.23.19.166:8500 check fall 3 rise 2
server serv2_8387 10.23.19.167:8500 check fall 3 rise 2
#######################
Thanks ,
Sri