Consult for redirecting http to https via HAproxy

user_14646164 0
Viewed 520

I am trying to configure the HAproxy to make it redirect the http traffic to https, but Chrome failed with "ERR_SSL_PROTOCOL_ERROR". However, if I used https directly it will work.

For example: If I typed https://:5443, it will display the page of backend servers. If I typed http://:5006, it should be redirected but just failed with the error mentioned above.

Here is my config:

frontend    simple_webapp    
    mode    http
    bind    *:5006
    bind    *:5443  ssl crt /root/Downloads/simple_webapp_all.pem
    http-request redirect scheme https unless { ssl_fc }

    default_backend simple_webapp

backend simple_webapp
    balance     roundrobin
    server      centos8-1 <server ip1>:5006 check 
    server      centos8-2 <server ip2>:5006 check

Please correct me if there is any misconfiguration.

haproxy
2 Answers

You probably expected that you changed port with scheme, but you haven't. Your request to http://foo:5006/ gets redirected to https://foo:5006, which doesn't support SSL. If you omit port in URL then browsers and web clients are smart enough to use port 80 for HTTP and 443 for HTTPS. That's why it works for default ports. So try to change your redirect to something like this:

http-request redirect prefix https://your_domain_as_explicit_string:5443 unless { ssl_fc }

You can experiment with headers, like

http-request redirect prefix https://%[hdr(host),regsub(:5006,:5443)] unless { ssl_fc }

hdr(host) includes in this case :5006, so that's changed with regsub

user_144615310

Once I changed the port from 5006 to others, it works fine. No clue what happened on this port.

user_146461640
Related