Re: I can't disable TLS v1.1 from Internet

Am 24.10.22 um 15:50 schrieb Aleksandar Lazic: Hi Roberto. On 24.10.22 03:21, Roberto Carna wrote: Dear, I have this scenario: Internet --> HAproxy Frontend --> HAproxy Backend --> Web servers What is the config for the frontend of the HAProxy Frontend? BTW.: HAProxy 1.5 is't maintained any

haproxy 2.6.0 and quic

Hi, we are using haproxy 2.4.17 at the moment. i have compiled haproxy 2.6 with quic support and quctls when i no check my config i get /opt/haproxy-260# /opt/haproxy-260/sbin/haproxy -c -f haproxy.cfg [NOTICE] (35905) : haproxy version is 2.6.0-a1efc04 [NOTICE] (35905) : path to executa

Seamless Restarts/Reloads in haproxy and master/worker-mode 1.8.

i have upgraded to version 1.8. and so far everything works. i have to questions about the new features: 1) seamless reload one of the new features ist seamless restarts. it is also said, that even an version upgrade should work. how do i achieve this? at the moment my startup script is very

haproxy 1.8.0 and http/2

hi, i just want to thank the haproxy team for making such a great programme. i have updated our production server to haproxy 1.8.0 and now be able to support http/2 to clients via haproxy. no need to change the backend servers as they still run on http/1.1. thanxs to the haproxy team Markus

Re: redirect scheme and error 503 (in logs)

ne. i can use the redirect scheme in my frontend section thanxs > On Tue, Sep 12, Markus Rietzler wrote: >> Am 12.09.17 um 22:11 schrieb Markus Rietzler: >>> i have some acls in my haproxy.cfg. >>> i want to do a http https redirection for some of my urls >>> >

Re: redirect scheme and error 503 (in logs)

Am 12.09.17 um 22:11 schrieb Markus Rietzler: > i have some acls in my haproxy.cfg. > i want to do a http https redirection for some of my urls > > > acl pathContent path_beg /foo /bar > acl is_root path -i / > redirect scheme https code 301 if redirect_neander pat

redirect scheme and error 503 (in logs)

i have some acls in my haproxy.cfg. i want to do a http https redirection for some of my urls acl pathContent path_beg /foo /bar acl is_root path -i / redirect scheme https code 301 if redirect_neander pathContent redirect scheme https code 301 if redirect_neander is_root i sometimes

Re: redirect scheme except some urls/params

Am 09.09.17 um 16:03 schrieb Markus Rietzler: > hi, > > i want activate redirection from http to https for my sites. but my problem > is, that there are certain requests, which > can't be redirected to https. > > so i have to write some acls to check this. &g

redirect scheme except some urls/params

hi, i want activate redirection from http to https for my sites. but my problem is, that there are certain requests, which can't be redirected to https. so i have to write some acls to check this. the urls which can't be redirected all contains client=, they can look like: - /path/what=all

Re: Two way authentication issue

Am 25.08.17 um 08:49 schrieb Lukas Tribus: > Hello, > > > Am 25.08.2017 um 01:47 schrieb Keresztes Péter-Zoltán: >> Hello >> >> Basically what I need is when I browse /service/ws to use client certificate >> authentication otherwise for everything else to use normal ssl termination > > this is

Re: High Availability for haproxy itself

Am 02.06.17 um 11:35 schrieb Raphaël Enrici: > Hi, > > if you are in a simple case where you only need some kind of active/passive > solution without big scaling needs on a > Linux system, look for "haproxy keepalived" on your favorite search engine, > you'll find many articles explaining the wa

Re: HAProxy 1.5 vs 1.6

Am 10.11.16 um 10:24 schrieb Pavlos Parissis: > On 09/11/2016 09:20 μμ, Steven Le Roux wrote: >> Hi a first good coverage for a comparison between 1.5 and 1.6 would be >> http://blog.haproxy.com/2015/10/14/whats-new-in-haproxy-1-6/ >> >> 1.6 is perfectly considered stable and hasn't seen any mainte

Re: New to haproxy questions

Am 17.01.15 um 03:38 schrieb Jeff Zellner: > 5) Is there a relatively simple way to get "true HA" with a redundant load > balancer? We have two identical machines side-by-side running EL6 and haproxy, > one is a disk dd of the other. In the past we used heartbeat with limited > success; pacemaker h

Re: HAProxy and SSL through and through

Am 18.07.14 15:48, schrieb Jacob Gibson: > I realize that not everyone may have had those old messages around. I have > included my original post below. Also, I've > read that using the ssl sessionid is not reliable so I'm looking for an > alternative. > > I was happily using HAProxy, until I

ssl compression

hi, i am just in the process of reviewing/correcting/hardening my ssl setup. haproxy uses ssl-termination on the frontend. this works very well. i also use ssl on the backand - due to the setup of our application and apache config - this also works very well. when i run a ssl check with globals

Re: [ANNOUNCE] haproxy-1.5.0

Am 19.06.14 22:01, schrieb Ryan O'Hara: > On Thu, Jun 19, 2014 at 09:54:29PM +0200, Willy Tarreau wrote: >> Hi everyone, >> >> The list has been unusually silent today, just as if everyone was waiting >> for something to happen :-) >> >> Today is a great day, the reward of 4 years of hard work. I'm

warning tune.ssl.default-dh-param

i, with dev26 and now the release of version 1.5. i get the following warning when starting haproxy: Starting haproxy: [WARNING] 170/090803 (38826) : Setting tune.ssl.default-dh-param to 1024 by default, if your workload permits it you should set it to at least 2048. Please set a value >= 1024 t

ssl client certificate passthrough/verify only with certain path

hi, i use haproxy 1.5dev24 with ssl-frontend, haproxy connects via ssl to backends. what i want to achieve is a secure access to certain internal or admin pages. best would be a three step check: 1) all clients with certain ip-adresses are allowed 2) if from unkown ip-address then client ssl cer

Re: haproxy-1.5-dev23 and ssl handshake failure

> > Markus, please follow Willy's advise and remove all force-* configurations > from your bind line, you should use no-sslv3/no-tlsv1[0-2] keywords to > configure specific TLS version, but in this case, as long as you > troubleshooting this, I strongly suggest to not configure any specific TLS >

Re: haproxy for ajp (tomcat)?

Am 25.04.14 19:53, schrieb Kobus Bensch: > Hi Paul > > We use haproxy to multiple https servers. After this we have a separate > tomcat server for each http server. So a one to one relationship between > Apache and tomcat. We then use apache to shop to the tomcat servers. > > -

Re: HAproxy and Mysql

Am 25.04.14 04:25, schrieb Ben Timby: > My only feedback is that haproxy has a lot of features that make it useful as > a MySQL frontend. The stats are great for > sizing and monitoring purposes. Timeouts and queuing are also great for > managing load etc. I used to run haproxy in > front of a si

Re: haproxy-1.5-dev23 and ssl handshake failure

>> my problem is, that i sometimes see an error message in my browser. i >> also got one response from a user saying that he can't access our >> ssl-pages and gets an error. > > There are 2 issues here: > - the fact that you sometimes (?) see this error in the browser > - the fact that one user c

Re: haproxy-1.5-dev23 and ssl handshake failure

Am 24.04.14 03:19, schrieb Stefan: > We also have a lot of "SSL handshake failure" records in log file > > Here some details on configs: > > - haproxy -vv: > HA-Proxy version 1.5-dev23-8317b28 2014/04/23 > Copyright 2000-2014 Willy Tarreau > > Build options : > TARGET = linux2628 > CPU

Re: haproxy-1.5-dev23 and ssl handshake failure

Am 23.04.14 22:59, schrieb Willy Tarreau: > Hi again Markus, > > I've checked my own logs and found SSL handshake failures starting > on April 8th, or the day after Heartbleed was disclosed, as can be > seen below with the number of errors per day : > > # err date > 2 Mar 27 > 2 Mar

haproxy-1.5-dev23 and ssl handshake failure

today i have switch to dev23. everything is working very well in our environment. haproxy works perfect in http mode. load balancing our two backend servers with master/slave and backup setup. i also use haproxy for ssl terminiation. exakt: haproxy takes ssl requests to our shop and then do ssl