0

I have a server with HAProxy setup. I am trying to connect my public ip to multiple servers that offer DIFFERENT services via external ports.

So Port 80 will direct to Server 1, Port 100 will forward to Server 2 etc..

This part is working so far, I have trouble getting my ssl cert from the haproxy server to pass traffic with the cert. When I try to access the site other then the main site with haproxy running. I get the following error. 

NET::ERR_CERT_COMMON_NAME_INVALID

I have done quite a bit of browsing Stack Exchange, google, forums. I have wiped the first segments of my IPs from the config below. They are there in my config on my server. I have also wiped the cipher from the config below.

What is missing?

global
    log /dev/log    local0
    log /dev/log    local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
    stats timeout 30s
    user haproxy
    group haproxy
    daemon
    maxconn 2048
    tune.ssl.default-dh-param 2048

    # Default SSL material locations
    ca-base /etc/ssl/certs
    #ca-base /etc/haproxy/certs/
    crt-base /etc/ssl/private

    # Default ciphers to use on SSL-enabled listening sockets.
    # For more information, see ciphers(1SSL). This list is from:
    #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
    # An alternative list with additional directives can be obtained from
    #  https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
    ssl-default-bind-ciphers xxxx
    ssl-default-bind-options no-sslv3

defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    timeout connect 5000
    timeout client  50000
    timeout server  50000
    option forwardfor
    option http-server-close
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 504 /etc/haproxy/errors/504.http

    frontend www-http
    #bind x.x.x.250:80
    #bind x.x.x.26:2000
    bind *:80
    reqadd X-Forwarded-Proto:\ http

    acl url_red path_beg /red
    use_backend red-backend if url_red

    default_backend www-backend
    #default_backend www-backend

    #acl url_prox path_beg /prox
    #use_backend prox-beckend if url_prox

frontend www-https
    bind x.x.x.250:443 ssl crt /etc/haproxy/certs/roots.systems.pem
    #bind x.x.x.26:2000 ssl crt /etc/haproxy/certs/roots.systems.pem
    reqadd X-Forwarded-Proto:\ https
    acl letsencrypt-acl path_beg /.well-known/acme-challenge/
    use_backend letsencrypt-backend if letsencrypt-acl
    #default_backend www-backend

    acl url_prox path_beg /prox
    use_backend prox-backend if url_prox

    acl url_red path_beg /red
    use_backend red-backend if url_red

    default_backend www-backend

backend www-backend
    redirect scheme https if !{ ssl_fc }
    #server www-1 x.x.x.25:80 check
    #server www-2 x.x.x.27:2551 check
    server www-3 127.0.0.1:84 check

backend letsencrypt-backend
    server letsencrypt 127.0.0.1:54321

backend prox-backend
    redirect scheme https if !{ ssl_fc }
    server prox01 x.x.x.25:1457   check inter 2000

backend red-backend
    redirect scheme https if !{ ssl_fc }
    server www-1 x.x.x.26:2000   check

'

EDIT: Forgot to mention that I do have a CNAME record on my domain that will forward all subdomains back to the public IP of the domain.

So when accessing service a is needed, go to test.example.com

Matt
  • 1
  • 3
  • Please excuse the comments. I have tried many methods and commented out instead of deleting to reference back whats been done and hasn't. – Matt Mar 28 '19 at 16:39
  • It feels like we're going to need a real hostname to test against... but first, what is in `/etc/haproxy/certs/roots.systems.pem`? I'm not asking to see the contents, of course, since there should be private keys in there, but please describe what that contains and how you created it. – Michael - sqlbot Mar 29 '19 at 00:27
  • I actually just got it to work, I found that shortly after. Posting a detailed answer now. – Matt Mar 29 '19 at 00:44

1 Answers1

0

Got it.

Run "openssl x509 -in YourCert.pem -text -noout" and compare with https://www.ssllabs.com/ssltest/

This confirmed that an old certificate was being used. After further investigation a cert call was being overridden in the configuration file. This solved the cert problem. For using multiple services with one public ip needed this configuration technique instead: 

acl is_site2 hdr(host) -i something.example.com
use_backend site2 if is_site2
Matt
  • 1
  • 3