Hi, We tested HAProxy to load ca-file from directory for backend encryption in 2 different systems (Redhat 2.6.18 and 2.6.32).
backend SFARM-SSL-PROXY server REMOTE remote.sample.com:443 ssl ca-file /opt/etc/ca.d/ The ca-file loading from directory failed in 2.6.18 system with this message during startup: unable to load CA file '/opt/etc/ca.d/'. It seems to me the HAProxy in this system doesn't support directory loading ca-file? However, in 2.6.32 system the HAProxy started up successfully. Here is the HAProxy build info for 2 systems: 2.6.18 (ca-file load from directory NOT working) HA-Proxy version 1.5.0 2014/06/19 Copyright 2000-2014 Willy Tarreau <[email protected]> Build options : TARGET = linux26 CPU = generic CC = gcc CFLAGS = -m64 -march=x86-64 -O2 -g -fno-strict-aliasing OPTIONS = USE_ZLIB=1 USE_OPENSSL=1 USE_PCRE=1 Default settings : maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 200 Encrypted password support via crypt(3): yes Built with zlib version : 1.2.3 Compression algorithms supported : identity, deflate, gzip Built with OpenSSL version : OpenSSL 1.0.1h 5 Jun 2014 Running on OpenSSL version : OpenSSL 1.0.1h 5 Jun 2014 OpenSSL library supports TLS extensions : yes OpenSSL library supports SNI : yes OpenSSL library supports prefer-server-ciphers : yes Built with PCRE version : 6.6 06-Feb-2006 PCRE library supports JIT : no (USE_PCRE_JIT not set) 2.6.32 (ca-file load from directory working) HA-Proxy version 1.5-dev21-6b07bf7 +2013/12/17 Copyright 2000-2013 Willy Tarreau <[email protected]> Build options : TARGET = linux2628 CPU = generic CC = gcc CFLAGS = -O2 -g -fno-strict-aliasing OPTIONS = USE_LIBCRYPT=1 USE_ZLIB=yes USE_OPENSSL=1 USE_STATIC_PCRE=1 Default settings : maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 200 Encrypted password support via crypt(3): yes Built with zlib version : 1.2.3 Compression algorithms supported : identity, deflate, gzip Built with OpenSSL version : OpenSSL 1.0.0-fips 29 Mar 2010 Running on OpenSSL version : OpenSSL 1.0.0-fips 29 Mar 2010 OpenSSL library supports TLS extensions : yes OpenSSL library supports SNI : yes OpenSSL library supports prefer-server-ciphers : yes Built with PCRE version : 7.8 2008-09-05 PCRE library supports JIT : no (USE_PCRE_JIT not set) Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND Does directory load for ca-file only work if HAProxy is built with TARGET=linux2628 ? Please advise. Diana
