Hi!
In 1.7.9 with crt-base and ca-base in global haproxy try to search crt for
server in ca-base. In bind all work as expected. If I specify the full path
for crt in server - it's ok.
# cat /tmp/haproxy.cfg
global
ca-base /etc/haproxy/ca-base
crt-base /etc/haproxy/crt-base
defaults
mode http
timeout connect 5s
timeout client 120s
timeout server 120s
frontend cs
bind *:4000 ssl crt test_combo.pem ca-file cabundle.pem verify required
default_backend cs
backend cs
server s1 1.2.3.4:4000 ssl crt test_combo.pem ca-file cabundle.pem verify
required
# haproxy -c -f /tmp/haproxy.cfg
[ALERT] 324/193009 (30768) : config : backend 'cs', server 's1': unable to
load SSL private key from PEM file '/etc/haproxy/ca-base/test_combo.pem'.
[ALERT] 324/193009 (30768) : Fatal errors found in configuration.
# haproxy -vv
HA-Proxy version 1.7.9 2017/08/18
Copyright 2000-2017 Willy Tarreau <wi...@haproxy.org>
Build options :
TARGET = linux2628
CPU = generic
CC = gcc
CFLAGS = -O2 -g -fno-strict-aliasing -Wdeclaration-after-statement
-fwrapv
OPTIONS = USE_LINUX_TPROXY=1 USE_ZLIB=1 USE_REGPARM=1 USE_OPENSSL=1
USE_LUA=1 USE_PCRE=1
Default settings :
maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200
Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.7
Running on zlib version : 1.2.7
Compression algorithms supported : identity("identity"),
deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017
Running on OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.32 2012-11-30
Running on PCRE version : 8.32 2012-11-30
PCRE library supports JIT : no (USE_PCRE_JIT not set)
Built with Lua version : Lua 5.3.4
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT
IP_FREEBIND
Available polling systems :
epoll : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.
Available filters :
[COMP] compression
[TRACE] trace
[SPOE] spoe
