Encryption Strategies

TLS offloading

With TLS offloading, HAProxy ALOHA encrypts messages between itself and the client, and then relays messages in the clear to backend servers over your internal network. This lets you store SSL/TLS certificates and keys on the HAProxy ALOHA only, rather than on multiple backend servers, which promotes better security and less processing on the servers.

You can use mode tcp or mode http.

1. On the LB Layer7 tab, add a bind line that listens on port 443 to the frontend or listen section for which you want to enable TLS.

   • Set the ssl argument.

   • Set the crt argument to the name of a certificate that you have defined on the SSL tab.

2. If you are using mode http, then you can add an http-request redirect line that automatically redirects HTTP traffic to HTTPS.

frontend ft_myapp
  mode http
  bind :80
  bind :443 ssl crt myapp

  # Redirect HTTP to HTTPS (works with 'mode http' only)
  http-request redirect scheme https code 301 unless { ssl_fc }

  default_backend bk_myapp

backend bk_myapp
  mode http
  server s1 10.0.0.11:80 check
  server s2 10.0.0.12:80 check

TLS passthrough

With TLS passthrough, HAProxy ALOHA does not manage TLS at all, but instead relays TLS-encrypted traffic through to backend servers. The servers are responsible for handling TLS encryption and decryption.

HAProxy ALOHA opens a TCP tunnel between the client and the server to let them negotiate and handle the TLS traffic.

You can use mode tcp.

• On the LB Layer7 tab, add a bind line that listens on port 443 to the frontend or listen section for which you want to enable TLS.

  The frontend listens on port 443 for HTTPS traffic, but does not decipher the TLS. The backend servers handle the encryption and decryption. Because the frontend uses mode tcp, it cannot do an HTTP redirect from HTTP to HTTPS.

  frontend ft_myapp
    mode tcp
    bind :443
    default_backend bk_myapp
  
  backend bk_myapp
    mode tcp
    server s1 10.0.0.11:443 check
    server s2 10.0.0.12:443 check

TLS bridging (re-encryption)

With TLS bridging, HAProxy ALOHA encrypts messages between itself and the client, and also encrypts messages relayed to backend servers. TLS certificates must be stored on both the HAProxy ALOHA and the servers.

You can use mode tcp or mode http.

1. On the LB Layer7 tab, add a bind line that listens on port 443 to the frontend or listen section for which you want to enable TLS.

   • Set the ssl argument.

   • Set the crt argument to the name of a certificate that you have defined on the SSL tab.

2. If you are using mode http, then you can add an http-request redirect line that automatically redirects HTTP traffic to HTTPS.

3. Set the ssl argument on the server lines in the backend, which indicates that HAProxy ALOHA connects to the servers over HTTPS.

frontend ft_myapp
  mode http
  bind :80
  bind :443 ssl crt myapp

  # Redirect HTTP to HTTPS (works with 'mode http' only)
  http-request redirect scheme https code 301 unless { ssl_fc }

  default_backend bk_myapp

backend bk_myapp
  mode http
  server s1 10.0.0.11:443 ssl check
  server s1 10.0.0.12:443 ssl check