HAproxy with multiple https sites

https haproxy
santhosh picture santhosh · May 21, 2012 · Viewed 15.9k times · Source

We have couple of http sites running behind load balancer ( with failover capability using hearbeat) and one https site. Everything is running fine but now i want to add another https site. I couldn't find any references for hosting multiple https sites.

Has anyone hosted multiple https sites using HAproxy ? Can you please tell me how can i achieve this ? pls help me with your inputs.

Thanks,

Santhosh

Answer

Ask Bjørn Hansen picture Ask Bjørn Hansen · Jun 3, 2012

You have to write rules to pick the backend either based on the frontend (IP address), Host header or TLS SNI ("Server Name Indicator"). What's best depends on your application really. If you need support for clients that don't support SNI (really old); then they won't get real TLS and you have to pick the backend based on the Host header.

Since I wrote the answer below haproxy has added ssl as a new feature. I use it on https://manage.ntppool.org/ and it's working nicely. You need the latest 1.5 development release (or 1.6 if that's out by the time you read this).

In HAProxy 1.8 http/2 is supported, too.

In 2012 the answer was:

HAProxy itself doesn't support SSL, you have to run an "SSL unwrapped" in front. Popular options are stunnel and stud. For HTTP you can also use Apache or Nginx.

Related questions

HAProxy redirecting http to https (ssl)

I'm using HAProxy for load balancing and only want my site to support https. Thus, I'd like to redirect all requests on port 80 to port 443. How would I do this? Edit: We'd like to redirect to the same url on …

Read More
How can I enable HTTP/2 on HAProxy?

We have recently shifted from HTTP to HTTPS. As we have already moved to HTTPS, we are thinking of moving to HTTP/2 to get performance benefits. As explained above that requests between browser and LB are secured (HTTPS) while communication …

Read More
When to use httpclose or http-server-close in haproxy

I have inherited a system where it has some performance issues due to network latency. We are using CentOS 5.x, and haproxy 1.5x The reason is that there is a lot of time spent on each API requests due to …

Read More