# Reverse SSL offloading configuration

**URL:** <https://discourse.haproxy.org/t/reverse-ssl-offloading-configuration/1242>\
**Category:** Help!\
**Created:** [May 15, 2017, 9:03pm UTC](https://discourse.haproxy.org/t/reverse-ssl-offloading-configuration/1242 "2017-05-15T21:03:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![gregwtmtno](https://avatars.discourse-cdn.com/v4/letter/g/c77e96/32.png) [@gregwtmtno](https://discourse.haproxy.org/u/gregwtmtno)\
**Post date:** [May 15, 2017, 9:03pm UTC](https://discourse.haproxy.org/t/reverse-ssl-offloading-configuration/1242/1 "2017-05-15T21:03:14Z")

</div>

Was wondering if it’s possible to use Haproxy in the following configuration.

```
Client --------------------> Haproxy -----------------------> Server (not controlled by me)
          Internal Network Internet
          TLS 1.0 Only TLS 1.2

```

In other words, I have a computer that needs to make outgoing connections using TLS 1.2, but it is only capable of TLS 1.0. I want to use haproxy to intercept and re-encrypt using TLS 1.2.

Any thoughts? Thanks!

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 16, 2017, 6:14am UTC](https://discourse.haproxy.org/t/reverse-ssl-offloading-configuration/1242/2 "2017-05-16T06:14:24Z")

</div>

Yes, you can, just specify the ssl keyword on both sides. If you want to verify the server certificate, make sure you set the ca-file.

---

<div class="post-metadata">

**Author:** ![gregwtmtno](https://avatars.discourse-cdn.com/v4/letter/g/c77e96/32.png) [@gregwtmtno](https://discourse.haproxy.org/u/gregwtmtno)\
**Post date:** [May 16, 2017, 11:41am UTC](https://discourse.haproxy.org/t/reverse-ssl-offloading-configuration/1242/3 "2017-05-16T11:41:13Z")

</div>

Hi Lukas,

Thank you for your response. I presume you are suggesting I specify the remote server as the backend in Haproxy terms? I can do this, and it does work, but there are some problems. Ideally I’d like the client (my computer) to be able to initiate a a connection to any TLS 1.2 server not just the backend. I don’t see a way to do this because I am limited to the remote that I set as backend. Also, Haproxy seems to create a persistant connection to the backend regardless of whether I set it to force-close mode or not. Because I don’t control the remote computer, I’d prefer to only connect to it when I’m using it.

Thanks again.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 16, 2017, 11:51am UTC](https://discourse.haproxy.org/t/reverse-ssl-offloading-configuration/1242/4 "2017-05-16T11:51:22Z")

</div>

Something can be done with option http\_proxy, but really haproxy is not made for this use case:  
[http://cbonte.github.io/haproxy-dconv/1.6/configuration.html#4-option%20http\_proxy](http://cbonte.github.io/haproxy-dconv/1.6/configuration.html#4-option%20http_proxy)

I suggest you look elsewhere for this functionality.

On the mailing list, exaproxy was mentioned once (I didn’t use it myself though):

> **[Exa-Networks/exaproxy](https://github.com/Exa-Networks/exaproxy)**
>
> Performant Content Modifying Non-Caching Proxy \[stable - accepting patches for bug fixes only\] - Exa-Networks/exaproxy

---

<div class="post-metadata">

**Author:** ![gregwtmtno](https://avatars.discourse-cdn.com/v4/letter/g/c77e96/32.png) [@gregwtmtno](https://discourse.haproxy.org/u/gregwtmtno)\
**Post date:** [May 16, 2017, 12:08pm UTC](https://discourse.haproxy.org/t/reverse-ssl-offloading-configuration/1242/5 "2017-05-16T12:08:34Z")

</div>

Thanks again! I’ll look in to it.