@jerald wrote:

I get the following error when attempting to access the https frontend url. I have not been able to pin down the configuration needed to resolve this issue:

Can’t connect securely to this page

This might be because the site uses outdated or unsafe TLS security settings. If this keeps happening, try contacting the website’s owner.

I have tried adding ssl force-tlsv* but still get the error. Any suggestions would be greatly appreciated.
( listen https_in :8443 ssl force-tlsv*)

root# haproxy -vv
HA-Proxy version 1.5.18 2016/05/10
Copyright 2000-2016 Willy Tarreau willy@haproxy.org

Build options :
TARGET = linux2628
CPU = generic
CC = gcc
CFLAGS = -O2 -g -fno-strict-aliasing -DTCP_USER_TIMEOUT=18
OPTIONS = USE_LINUX_TPROXY=1 USE_GETADDRINFO=1 USE_ZLIB=1 USE_REGPARM=1 USE_OPENSSL=1 USE_PCRE=1

Default settings :
maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 200

Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.7
Compression algorithms supported : identity, deflate, gzip
Built with OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017
Running on OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.32 2012-11-30
PCRE library supports JIT : no (USE_PCRE_JIT not set)
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND

Available polling systems :
epoll : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.

haproxy.cfg:

#---------------------------------------------------------------------

HTTPS Site Configuration

#---------------------------------------------------------------------
listen https_in :8443
mode tcp
balance source# Load Balancing algorithm
http-request set-header X-Forwarded-Proto https
server server1 :8443 weight 1 maxconn 512 ssl verify none check
server server2 :8443 weight 1 maxconn 512 ssl verify none check

Posts: 1

Participants: 1

Read full topic