Haproxy: Difference between revisions
No edit summary |
No edit summary |
||
| (5 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
==== Most important: check to ensure [https://www.ssllabs.com/ssltest ssllabs] | ==== Most important: continuously check ssllabs ==== | ||
Most important: continuously check to ensure [https://www.ssllabs.com/ssltest ssllabs] gives A+ rating for all sites. | |||
It's important to get a current [https://cipherli.st/ cipher configuration] right. | It's important to get a current [https://cipherli.st/ cipher configuration] right. | ||
==== SSL cert format ==== | |||
Haproxy wants a combined PEM format, with crt and keys included. Typical way: | |||
cat STAR_equityshift_io.crt > manual_combined.pem | |||
cat equityshift_io.key >> manual_combined.pem | |||
==== Config ==== | ==== Config ==== | ||
For working code to get an A+, work on the config, here: | For working code to get an A+, work on the config, here: | ||
🌵 m@bitpost [~/development/scripts/gentoo/bitpost/root] emacs haproxy.cfg | 🌵 m@bitpost [~/development/scripts/gentoo/bitpost/root] emacs haproxy.cfg | ||
It contains a list of all my sites that are currently live. | |||
After changing it, restart it: | After changing it, restart it: | ||
sudo /etc/init.d/haproxy restart | sudo /etc/init.d/haproxy restart | ||
Latest revision as of 16:56, 10 January 2020
Most important: continuously check ssllabs
Most important: continuously check to ensure ssllabs gives A+ rating for all sites.
It's important to get a current cipher configuration right.
SSL cert format
Haproxy wants a combined PEM format, with crt and keys included. Typical way:
cat STAR_equityshift_io.crt > manual_combined.pem cat equityshift_io.key >> manual_combined.pem
Config
For working code to get an A+, work on the config, here:
🌵 m@bitpost [~/development/scripts/gentoo/bitpost/root] emacs haproxy.cfg
It contains a list of all my sites that are currently live.
After changing it, restart it:
sudo /etc/init.d/haproxy restart
2019-12-08 It was updated to use a new config format to prevent ssl less than TLS1.2. It was also updated with an attempt to redirect www.* to *, but we need updated certificates with multiple names. certbot script was updated to add them, but it has not recreated certs yet. Check back in February at the latest!