Hello,
I am using haproxy (version 2.6.12) as a TLS proxy to serve a local TCP server.
I would like to log the TLS secret key as I was doing for TLS1.2 (with a lua on a tcp-request content and txn.sf:ssl_fc_session_key).
But for TLS1.3 I am getting nowhere, the variables are always empty.
Here is the extract of my configuration:
global
log stdout format raw daemon
user root
group root
tune.ssl.keylog on
lua-load sslkeylogger.lua
ssl-default-bind-ciphersuites TLS_AES_256_GCM_SHA384
ssl-default-server-ciphersuites TLS_AES_256_GCM_SHA38
frontend remote_client_to_local_server
# try to log an element
tcp-request session set-var(sess.early_secret) ssl_fc_client_early_traffic_secret
log-format "ssl_fc_client_early_traffic_secret: %[var(sess.early_secret)]"
# tcp-request content lua.sslkeylog /tmp/key.log if { ssl_fc }
bind 10.85.221.14:14443 ssl crt crt.pem ssl-min-ver TLSv1.3
default_backend backend_remote_client_to_local_server
backend backend_remote_client_to_local_server
mode tcp
tcp-request content lua.sslkeylog /tmp/key.log if { ssl_fc }
server local_server 127.0.0.1:14443
The lua script is the one provided here: haproxy/dev/sslkeylogger/sslkeylogger.lua at e1c8bfd0ed960d3b3dec39e78ad75bec117912d0 · haproxy/haproxy · GitHub
I added the tcp to the action register : core.register_action('sslkeylog', { "tcp-req", "http-req" }, sslkeylog, 1)
None of the variable define in the documentation (such as ssl_fc_client_early_traffic_secret) contains an element, they are always empty.
Also, the session variable (sess.early_secret) is empty too.
I don’t know what I might be doing wrong or if it is even possible for TLS1.3…
Thanks for your replies !