Versions Compared

Old Version 4

changes.mady.by.user Unknown User (weizhou)

Saved on

compared with

New Version 5

changes.mady.by.user Unknown User (weizhou)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

3.5 Haproxy configuration for SSL certificate in Virtual Router

The 


The SSL certificate and private key are saved in a pem file



Code Block
root@r-22-VM:~# cat /etc/cloudstack/ssl/10_0_57_11-443.pem 
-----BEGIN CERTIFICATE-----
// server certificate
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
// chain 1
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
// chain 2
-----END CERTIFICATE-----

-----BEGIN PRIVATE KEY-----
// private key
-----END PRIVATE KEY-----
  


HAproxy configuration for the load balancer


Code Block
listen 10_0_57_11-443
        bind 10.0.57.11:443 ssl crt /etc/ssl/cloudstack/10_0_57_11-443.pem alpn h2,http/1.1 ssl-min-ver TLSv1.2 no-tls-tickets ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256 ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384
        http-request add-header X-Forwarded-Proto https
        mode http
        option httpclose
        balance roundrobin
        server 10_0_57_11-443_0 10.1.1.149:80 check ssl-min-ver TLSv1.2 no-tls-tickets ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256 ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384
  
Code Block
example of haproxy.cfg


4. Test plan


This is automated by test/integration/smoke/test_ssl_offloading.py

...