1

I was trying to implement SSL termination with HAProxy.

This is how my haproxy.cfg looks like

frontend Local_Server
    bind *:443 ssl crt /home/vagrant/ingress-certificate/k8s.pem
    mode tcp
    reqadd X-Forwarded-Proto:\ https
    default_backend k8s_server

backend k8s_server
    mode tcp
    balance roundrobin
    redirect scheme https if !{ ssl_fc }
    server web1 100.0.0.2:8080 check

I have generated the self signed certificate which k8s.pem.

My normal URL (without https) is working perfectly fine .i.e. - http://100.0.0.2/hello

But when i try to access the same url with HTTPS .i.e.- https://100.0.0.2/hello i get 404 and when i checked my haproxy logs i can see following message

Jul 21 18:10:19 node1 haproxy[10813]: Server k8s_server/web1 is DOWN, reason: Layer4 connection problem, info: "Connection refused", check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Jul 21 18:10:19 node1 haproxy[10813]: Server k8s_server/web1 is DOWN, reason: Layer4 connection problem, info: "Connection refused", check duration: 0ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.

Any suggestions which i can incorporate in my haproxy.cfg ?

PS - The microservice which i am trying to access is deployed under kubernetes cluster with service exposed as ClusterIP

Rahul Wagh
  • 470
  • 1
  • 6
  • 23
  • Which version of HAProxy do you use? The message is clear. HAProxy can reach the server `100.0.0.2:8080`. What's the ouput of `curl -v --max-time 5 https://100.0.0.2:8080/`? – Aleksandar Jul 21 '20 at 22:41
  • I am using - HA-Proxy version 1.8.8-1ubuntu0.11 2020/06/22 Here is the console output of - curl -v --max-time 5 https://100.0.0.2:8080/ * Trying 100.0.0.2... * TCP_NODELAY set * connect to 100.0.0.2 port 8080 failed: Connection refused * Failed to connect to 100.0.0.2 port 8080: Connection refused * Closing connection 0 curl: (7) Failed to connect to 100.0.0.2 port 8080: Connection refused – Rahul Wagh Jul 22 '20 at 05:33
  • Well that's now clear why HAProxy can't connect to the server `curl: (7) Failed to connect to 100.0.0.2 port 8080: Connection refused `. You should fix this on the server `100.0.0.2:8080` – Aleksandar Jul 22 '20 at 07:30
  • 1
    I will check whats wrong with the server – Rahul Wagh Jul 22 '20 at 12:24

0 Answers0