时间戳

首页 > 解决方案 > 具有多个 https 站点的 HAproxy

haproxy - 具有多个 https 站点的 HAproxy

问题描述

我正在尝试通过 Haproxy 配置配置两个站点，现在我只保留

  1. https://hpc7065.eng.fireeye.com/hawkeye
  2. https://hpc7065.eng.fireeye.com/hue

下面是配置

frontend https-in
    mode tcp
    bind hpc7065.eng.fireeye.com:443 ssl crt /opt/cloudera/security/haproxy/final.pem
    balance source
    acl is_hawkeye url_beg hawkeye
    acl is_hue url_beg hue
    use_backend hue_cluster if is_hue

backend hue_cluster
    mode tcp
    balance source
    server Hue_1 hpc7021.eng.fireeye.com:8888 check
    server Hue_2 hpc7022.eng.fireeye.com:8888 check

backend hawkeye_cluster
    mode tcp
    balance source
    server Hue_1 hpc7021.eng.fireeye.com:8000 check
    server Hue_2 hpc7022.eng.fireeye.com:8000 check

错误

curl -k https://hpc7065.eng.fireeye.com/hue -vvv
* About to connect() to hpc7065.eng.fireeye.com port 443 (#0)
*   Trying 10.11.108.75...
* Connected to hpc7065.eng.fireeye.com (10.11.108.75) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* SSL connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* Server certificate:
*   subject: E=FenetDBTeam@FireEye.com,CN=hpc7065.eng.fireeye.com,OU=DTI-NG,O="FireEye, Inc.",L=Milpitas,ST=California,C=US
*   start date: May 22 10:11:52 2018 GMT
*   expire date: May 21 10:11:52 2020 GMT
*   common name: hpc7065.eng.fireeye.com
*   issuer: CN=FireEye Issuing CA 1
> GET /hue HTTP/1.1
> User-Agent: curl/7.29.0
> Host: hpc7065.eng.fireeye.com
> Accept: */*
> 
* Empty reply from server
* Connection #0 to host hpc7065.eng.fireeye.com left intact
curl: (52) Empty reply from server

标签： haproxy

解决方案

我必须通过在后端服务器上添加 ssl 关键字来解决问题，因为我的后端服务器不接受纯文本

frontend https-in
    mode http
    bind hpc7065.eng.fireeye.com:443 ssl crt /opt/cloudera/security/haproxy/final.pem
    balance source
    acl is_hawkeye url_beg hawkeye
    acl is_hue url_beg hue
    use_backend hue_cluster if is_hue

backend hue_cluster
    mode http
    balance source
    server Hue_1 hpc7021.eng.fireeye.com:8888 check ssl
    server Hue_2 hpc7022.eng.fireeye.com:8888 check ssl

backend hawkeye_cluster
    mode http
    balance source
    server Hue_1 hpc7021.eng.fireeye.com:8000 check ssl
    server Hue_2 hpc7022.eng.fireeye.com:8000 check ssl

推荐阅读