12

We have couple of http sites running behind load balancer ( with failover capability using hearbeat) and one https site. Everything is running fine but now i want to add another https site. I couldn't find any references for hosting multiple https sites.

Has anyone hosted multiple https sites using HAproxy ? Can you please tell me how can i achieve this ? pls help me with your inputs.

Thanks,

Santhosh

santhosh
  • 121
  • 1
  • 1
  • 3

3 Answers3

3

You have to write rules to pick the backend either based on the frontend (IP address), Host header or TLS SNI ("Server Name Indicator"). What's best depends on your application really. If you need support for clients that don't support SNI (really old); then they won't get real TLS and you have to pick the backend based on the Host header.

Since I wrote the answer below haproxy has added ssl as a new feature. I use it on https://manage.ntppool.org/ and it's working nicely. You need the latest 1.5 development release (or 1.6 if that's out by the time you read this).

In HAProxy 1.8 http/2 is supported, too.

In 2012 the answer was:

HAProxy itself doesn't support SSL, you have to run an "SSL unwrapped" in front. Popular options are stunnel and stud. For HTTP you can also use Apache or Nginx.

Ask Bjørn Hansen
  • 6,784
  • 2
  • 26
  • 40
  • Could you expand with an example of " frontend (IP address), Host header or TLS SNI ("Server Name Indicator"). " ? – realtebo Aug 23 '18 at 13:13
0

You can launch any number of HTTPS enabled website using HAProxy. You have to do SSL offloading at HAProxy box. And ha-proxy will redirect requests to your server(site-box) via HTTP. You can distinguish between requests coming for your 2 different https website by parsing your URI, after SSL-ffloading at HA-Proxy

See HA-Proxy docs for more details, see hdr_dom and acl sections this will solve your problem.

Ankit Jain
  • 798
  • 8
  • 20
0

Just for reference, you can get it with:

frontend http
    bind :80
    redirect scheme https code 301 if !{ ssl_fc }

frontend https
    bind :443 ssl crt /etc/haproxy/ssl
    reqadd X-Forwarded-Proto:\ https
    option http-server-close
    option forwardfor

    # ACL for example1.com
    acl ACL_example1.com hdr(host) -i example1.com
    use_backend backend1 if ACL_example1.com

    # ACL for example2.com
    acl ACL_example2.com hdr(host) -i example2.com
    use_backend backend2 if ACL_example2.com

backend backend1
    balance roundrobin
    server server1 192.168.1.10:80 check
    server server2 192.168.1.20:80 check

backend backend2
    balance roundrobin
    server server3 192.168.1.30:80 check
    server server4 192.168.1.40:80 check

In /etc/haproxy/ssl you must to have certificates in .pem format containing crt and key:

example1.com.pem
example2.com.pem

And use HAProxy above version 1.5

wiltonsr
  • 639
  • 5
  • 16