Haproxy TLS configuration

haproxy

I need to create haproxy with tls , although its working successfully with ssl certificate , i have done below configuration

global
    log 127.0.0.1 local0 debug
    ssl-default-bind-options no-sslv3 2048

Its giving below error , please suggest where should i change

[ALERT] 330/075452 (70779) : parsing [/etc/haproxy/haproxy.cfg:8] : unknown keyword 'ssl-default-bind-options' in 'global' section
[ALERT] 330/075452 (70779) : Error(s) found in configuration file : /etc/haproxy/haproxy.cfg
[WARNING] 330/075452 (70779) : Setting tune.ssl.default-dh-param to 1024 by default, if your workload permits it you should set it to at least 2048. Please set a value >= 1024 to make this warning disappear.
[ALERT] 330/075452 (70779) : Fatal errors found in configuration.

Best Answer

Try:

global
  log 127.0.0.1 local0 debug
  ssl-default-bind-options no-sslv3
  tune.ssl.default-dh-param 2048

Related Solutions

HAProxy configuration and modification

How it works Basically it's a load balancer. You put HAProxy in front of Web Servers, and it will split the load/traffic between them based on the balance algorithm you chose.
How do I configure it? It has a single config file /etc/haproxy/haproxy.cfg . For the most simple configuration you define one frontend with one or more backends (the web servers behind haproxy). Something like this:
```
listen frontend *:80
   mode http
   balance roundrobin
   server backend1 192.168.1.2:80 cookie A check
   server backend2 192.168.1.3:80 cookie B check
```
How do I modify(add/remove) the already configured file? You just need to edit the file, At this time doesn't exist the option to use include files for configurarion. To apply the changes you need to restart haproxy.
How do I start/restart the HA Proxy after modifying the configuration file? If you have installed haproxy from a ubuntu/centos package you need:

/etc/init.d/haproxy restart
Even I don't know how to check my current installed HA Proxy version? If you're using CentOS:

rpm -qi haproxy

Check this document: http://haproxy.1wt.eu/download/1.3/doc/architecture.txt . It will guide you through different architectures for differente needs.

Dynamic HAProxy configuration

If you authorize your stats socket, you can send commands to it.

From the 1.4 documentation

disable server <backend>/<server>

Mark the server DOWN for maintenance. In this mode, no more checks will be performed on the server until it leaves maintenance. If the server is tracked by other servers, those servers will be set to DOWN during the maintenance.

In the statistics page, a server DOWN for maintenance will appear with a "MAINT" status, its tracking servers with the "MAINT(via)" one.

Both the backend and the server may be specified either by their name or by their numeric ID, prefixed with a sharp ('#').

This command is restricted and can only be issued on sockets configured for level "admin".

You can use this to effectively add and remove servers from active service.

Barring that, you can use option httpchk and block the check requests on the appserver side when a server should leave or join the balancing group. This requires some means to centrally manage that, of course.

Best Answer

Related Solutions

HAProxy configuration and modification

Dynamic HAProxy configuration

Related Topic