Hello Oliver,
Am 21.11.2016 um 17:43 schrieb Wood, Oliver:
Hello,
I’ve what feels like a very simple problem, but that I cannot get to work.
I’ve two backends, and I wish to route HTTPS traffic to them based on the
original source request, without SSL offloading. I ran across
http://blog.haproxy.com/2012/04/13/enhanced-ssl-load-balancing-with-server-name-indication-sni-tls-extension/
which appears to be a very simple pattern to follow.
However, no matter what I do, I can’t seem to make it work.
My haproxy.cfg:
https://gist.github.com/oli-logicnow/08a6e05fe6943e30cd9e26d20fa4d5be
HA-Proxy version 1.6.4 2016/03/13
If I include the default_backend then everything flows to it.
If I test either backend without including the acl based stuff they work fine.
If I uncomment the “download” sections it makes no different (the version I’ve
linked to was trying to minimise the amount of config included).
I’ve sanitised the URLs, but kept the same structure incase the slightly
unusual 3 domain deep api.test.example.com was a problem.
When I curl the endpoints from my machine what gets logged isn’t giving me any
clues.
You are missing some required configuration (as per the blog post you
linked above):
# use tcp content accepts to detects ssl client and server hello.
tcp-request inspect-delay 5s
tcp-request content accept if clienthello
If thats not it; are you sure this is not just a curl issue, like a
ancient curl release without SNI support or build against an exotic SSL lib?
Please provide the outputs:
haproxy -vv
curl --version
curl -Ivvvvv https://downloads.example.com/real-file.zip
You could also tcpdump the SSL traffic to see if it actually contains
the SNI value.
cheers,
Lukas
