haproxy可以实现https的证书安全,从用户到haproxy为https,从haproxy到后端服务器用http通信 ,但是基于性能考虑,生产中证书都是在后端服务器比如nginx上实现。
配置HAProxy支持https协议,支持ssl会话:
bind *:443 ssl crt /PATH/TO/SOME_PEM_FILE
指令 crt 后证书文件为PEM格式,需要同时包含证书和所有私钥:
cat demo.key demo.crt > demo.pem
把80端口的请求重向定443:
bind *:80 redirect scheme https if !{ ssl_fc }
一、实验环境
haproxy:172.25.254.100
RS1:172.25.254.10
RS2:172.25.254.20
web服务:nginx
关闭防火墙和SELinux
systemctl stop firewalld
setenforce 0
二、实现步骤
1、制作证书
haproxy:
[root@haproxy ~]# mkdir -p /etc/haproxy/certs
[root@haproxy ~]# openssl req -newkey rsa:2048 -nodes -sha256 –keyout /etc/haproxy/certs/ouqisheng.org.key -x509 -days 365 -out /etc/haproxy/certs/ouqisheng.org.crt
[root@haproxy ~]# cat /etc/haproxy/certs/ouqisheng.org.key /etc/haproxy/certs/ouqisheng.org.crt > /etc/haproxy/certs/ouqisheng.pem
2、配置haproxy
vim /etc/haproxy/haproxy.cfg
重启服务:
systemctl restart haproxy.service
3、测试结果
添加本地解析:
vim /etc/hosts
测试:
标签:Haproxy,haproxy,ouqisheng,crt,实现,etc,certs,https From: https://blog.csdn.net/weixin_63657273/article/details/141098365