HAProxy 1.5 supports SSL offloading and downstream encryption
blog.exceliance.fr
HAProxy 1.5 supports SSL offloading and downstream encryption
1–10 of 18 posts
Re: HAProxy 1.5 supports SSL offloading and downstream encryption
#2I'm so glad to see that haproxy is finally adding native SSL support.
I have used stunnel (http://www.stunnel.org/) in front of HAProxy up to now. That setup works. But I'm happy that in the future I can remove one of the moving parts from my machine and just use haproxy.
Re: HAProxy 1.5 supports SSL offloading and downstream encryption
#3Great to see another hole in secure connections being plugged.
Re: HAProxy 1.5 supports SSL offloading and downstream encryption
#4I wonder if it supports SNI for virtual SSL hosts?
Re: HAProxy 1.5 supports SSL offloading and downstream encryption
#5I wonder if it supports SNI for virtual SSL hosts?
+1 If it did, that'd be really, really helpful.
The spec is pretty simple, I don't know why SSL implementations leave it off. :(
Re: HAProxy 1.5 supports SSL offloading and downstream encryption
#6This is great, exactly when I need it.
Re: HAProxy 1.5 supports SSL offloading and downstream encryption
#7I wonder if it supports SNI for virtual SSL hosts?
It does http://permalink.gmane.org/gmane.comp.web.haproxy/8134 Last I heard, it was buggy unless you used a specific build from April http://blog.exceliance.fr/2012/04/13/enhanced-ssl-load-balan... but it may have improved since.
Re: HAProxy 1.5 supports SSL offloading and downstream encryption
#8What I would like to see is a way to change the HAProxy configuration on the fly, or something like a configuration backend. That would avoid reloading HAProxy after each config change, and allow a much more flexible configuration.
Re: HAProxy 1.5 supports SSL offloading and downstream encryption
#9What I would like to see is a way to change the HAProxy configuration on the fly, or something like a configuration backend. That would avoid reloading HAProxy after each config change, and allow a much more flexible configuration.
Why is haproxy reloading an issue ? It works pretty well in my experience (although I am not in the web business anymore, so things may have changed in the last two years).
Re: HAProxy 1.5 supports SSL offloading and downstream encryption
#10What I would like to see is a way to change the HAProxy configuration on the fly, or something like a configuration backend. That would avoid reloading HAProxy after each config change, and allow a much more flexible configuration.
Why is haproxy reloading an issue ? It works pretty well in my experience (although I am not in the web business anymore, so things may have changed in the last two years).
Reloading is no issue when you have few frontends or backends. But when you have a lot of front- or backends, the configuration file will be huge, and reloading will take some time. If you need to reload every few seconds, this might even cause downtime. But I guess our workload is not the usual implementation of HAProxy...