Le 20/12/2017 à 02:44, Andrew Heberle a écrit :
I am attempting to utilise certificate bundles so we can have multi-type
certs in haproxy however this seems non-functional.
I have a two cert bundles as follows (only testing with RSA certs at the
moment):
/etc/haproxy/ssl # ls -l /etc/haproxy/ssl/
total 16
-rw-r--r-- 1 root root 1184 Dec 20 01:39 test1.pem.issuer.rsa
-rw-r--r-- 1 root root 2888 Dec 20 01:26 test1.pem.rsa
-rw-r--r-- 1 root root 1184 Dec 20 01:40 test2.pem.issuer.rsa
-rw-r--r-- 1 root root 2888 Dec 20 01:30 test2.pem.rsa
With the following config of my two front-ends:
frontend test1
bind *:5000 ssl crt test1.pem
default_backend app1
frontend test2
bind *:5001 ssl crt test2.pem
default_backend app2
But this then fails:
/etc/haproxy/ssl # haproxy -f /etc/haproxy/haproxy.cfg -c
[ALERT] 353/014339 (59) : parsing [/etc/haproxy/haproxy.cfg:34] : 'bind
*:5000' : unable to stat SSL certificate from fi
le '/etc/haproxy/ssl/test1.pem' : No such file or directory.
[ALERT] 353/014339 (59) : parsing [/etc/haproxy/haproxy.cfg:38] : 'bind
*:5001' : unable to stat SSL certificate from fi
le '/etc/haproxy/ssl/test2.pem' : No such file or directory.
[ALERT] 353/014339 (59) : Error(s) found in configuration file :
/etc/haproxy/haproxy.cfg
[ALERT] 353/014339 (59) : Fatal errors found in configuration.
Build Options:
HA-Proxy version 1.7.9 2017/08/18
Copyright 2000-2017 Willy Tarreau <[email protected]
<mailto:[email protected]>>
Build options :
TARGET = linux2628
CPU = generic
CC = gcc
CFLAGS = -Os -fomit-frame-pointer
OPTIONS = USE_ZLIB=1 USE_OPENSSL=1 USE_LUA=1 USE_PCRE=1
Default settings :
maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200
Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.11
Running on zlib version : 1.2.11
Compression algorithms supported : identity("identity"),
deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with OpenSSL version : LibreSSL 2.6.3
Running on OpenSSL version : LibreSSL 2.6.3
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.41 2017-07-05
Running on PCRE version : 8.41 2017-07-05
PCRE library supports JIT : no (USE_PCRE_JIT not set)
Built with Lua version : Lua 5.3.4
Built with transparent proxy support using: IP_TRANSPARENT
IPV6_TRANSPARENT IP_FREEBIND
Available polling systems :
epoll : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.
Available filters :
[COMP] compression
[TRACE] trace
[SPOE] spoe
Hi,
LibreSSL is API compatible with OpenSSL 1.0.1. So it does not support
multiple certificates for the same CN. It only works for OpenSSL >=
1.0.2. However, the error message is misleading.
--
Christopher
