Haproxy: Difference between revisions

From Bitpost wiki
No edit summary
No edit summary
 
(5 intermediate revisions by the same user not shown)
Line 1: Line 1:
==== Most important: check to ensure [https://www.ssllabs.com/ssltest ssllabs] continuously gives A+ rating ====
==== Most important: continuously check ssllabs ====
 
Most important: continuously check to ensure [https://www.ssllabs.com/ssltest ssllabs] gives A+ rating for all sites.


It's important to get a current [https://cipherli.st/ cipher configuration] right.
It's important to get a current [https://cipherli.st/ cipher configuration] right.
==== SSL cert format ====
Haproxy wants a combined PEM format, with crt and keys included.  Typical way:
cat STAR_equityshift_io.crt > manual_combined.pem
cat equityshift_io.key >> manual_combined.pem


==== Config ====
==== Config ====
For working code to get an A+, work on the config, here:
For working code to get an A+, work on the config, here:
   🌵 m@bitpost  [~/development/scripts/gentoo/bitpost/root] emacs haproxy.cfg  
   🌵 m@bitpost  [~/development/scripts/gentoo/bitpost/root] emacs haproxy.cfg  
It contains a list of all my sites that are currently live.
After changing it, restart it:
After changing it, restart it:
  sudo /etc/init.d/haproxy restart
  sudo /etc/init.d/haproxy restart

Latest revision as of 16:56, 10 January 2020

Most important: continuously check ssllabs

Most important: continuously check to ensure ssllabs gives A+ rating for all sites.

It's important to get a current cipher configuration right.

SSL cert format

Haproxy wants a combined PEM format, with crt and keys included. Typical way:

cat STAR_equityshift_io.crt > manual_combined.pem 
cat equityshift_io.key >> manual_combined.pem 

Config

For working code to get an A+, work on the config, here:

 🌵 m@bitpost  [~/development/scripts/gentoo/bitpost/root] emacs haproxy.cfg 

It contains a list of all my sites that are currently live.

After changing it, restart it:

sudo /etc/init.d/haproxy restart

2019-12-08 It was updated to use a new config format to prevent ssl less than TLS1.2. It was also updated with an attempt to redirect www.* to *, but we need updated certificates with multiple names. certbot script was updated to add them, but it has not recreated certs yet. Check back in February at the latest!

Intro

SSL