show tls-keys

Description

TLS session tickets are enabled by default in HAProxy Enterprise. However, the underlying OpenSSL library uses its own auto-generated key to encrypt the tickets unless you set the tls-ticket-keys parameter on the bind line in the frontend or listen section of your configuration. This parameter points to the file containing a list of your own secret keys to use upon startup.

Use show tls-keys to show the contents of your key file. You can also use the set ssl tls-key command to rotate in a new secret key without requiring a reload.

Examples

In this example, we generate secret keys for a website named test.local.

1. Create a directory to hold your secret keys:

   $ sudo mkdir /etc/ssl/tls-ticket-keys

2. Generate three secret keys and store them in the file /etc/ssl/tls-ticket-keys/test.local.key by calling the following command three times:

   $ echo "`openssl rand 80 | openssl base64 -A`" | \
     sudo tee -a /etc/ssl/tls-ticket-keys/test.local.key > /dev/null

3. Add the tls-ticket-keys parameter to the bind line in the frontend or listen section of your configuration.

   This points to the file containing a list of secret keys to use upon startup.

   frontend fe_main
      bind :80
      bind :443 ssl  crt /etc/hapee-1.6/certs/site.pem  tls-ticket-keys /etc/ssl/tls-ticket-keys/test.local.key
      http-request redirect scheme https unless { ssl_fc }
      default_backend webservers

4. Call show tls-keys with no parameters to list all key files:

   $ echo "show tls-keys" | sudo socat stdio /var/run/hapee-1.6/hapee-lb.sock
   
   # id (file)
   0 (/etc/ssl/tls-ticket-keys/test.local.key)

5. To view the keys in a file, call show tls-keys with the path to the file (or its numeric ID):

   $ echo "show tls-keys /etc/ssl/tls-ticket-keys/test.local.key" | \
     sudo socat stdio /var/run/hapee-1.6/hapee-lb.sock
   
   # id secret
   # 0 (/etc/ssl/tls-ticket-keys/test.local.key)
   0.0 foNecGaN+zlgI3TlsT/pLJ9d7ZRoSZ2nmXZq29BSRWIErYTwK1RfZs3XfImaruR8ovJ1lAmZxiE2+tHSwypa7Cqq01hczTn2EN1C3anecys=
   0.1 7VsH1P4H/N8MOLewQMOMOPjDa8ZCddHzLYe7JH/ydhg8JIO8yf1rg7JqAUbN2WoTzFlY0MhQKQSibARLQk1Ff0Ki12dma1/L7/W5xtgQANQ=
   0.2 BiSBxvngSPguqzteXXxCk8WrnimwCSuOapx4koBv01Bei8N00HuJIBce8w324xsYhiUpxcF4RbR6nGoMXOf1LkboQykFPnohTYOgfy4SPFE=

See also

• set ssl ocsp-response

• set ssl tls-key