haproxy 代理 ssl 有两种方式
1、haproxy 本身提供ssl 证书,后面的web 服务器走正常的http
2、haproxy 本身只提供代理,后面的web服务器https
第一种方式
需要编译haproxy 支持ssl,编译参数:
make TARGET=linux26 USE_OPENSSL=1 ADDLIB=-lz
ldd haproxy | grep ssl
libssl.so.10 => /usr/lib64/libssl.so.10 (0x00007fb0485e5000)
配置参数:
frontend https_frontend
bind *:443 ssl crt /etc/ssl/certs/servername.pem
mode http
option httpclose
option forwardfor
reqadd X-Forwarded-Proto:\ https
default_backend web_server
backend web_server
mode http
balance roundrobin
cookie SERVERID insert indirect nocache
server s1 192.168.250.47:80 check cookie s1
server s2 192.168.250.49:80 check cookie s2
注意:这里的pem 文件是下面两个文件合并而成:
cat servername.crt servername.key |tee servername.pe