HAProxy Enterprise Documentation 1.9r1

show tls-keys

Display the secret keys used to encrypt TLS session tickets.

Description

TLS session tickets are enabled by default in HAProxy Enterprise. However, the underlying OpenSSL library uses its own auto-generated key to encrypt the tickets unless you set the tls-ticket-keys parameter on the bind line in the frontend or listen section of your configuration. This parameter points to the file containing a list of your own secret keys to use upon startup.

Use show tls-keys to show the contents of your key file. You can also use the set ssl tls-key command to rotate in a new secret key without requiring a reload.

Examples

In this example, we generate secret keys for a website named test.local.

  1. Create a directory to hold your secret keys:

    $ sudo mkdir /etc/ssl/tls-ticket-keys
  2. Generate three secret keys and store them in the file /etc/ssl/tls-ticket-keys/test.local.key by calling the following command three times:

    $ echo "`openssl rand 80 | openssl base64 -A`" | \
      sudo tee -a /etc/ssl/tls-ticket-keys/test.local.key > /dev/null
  3. Add the tls-ticket-keys parameter to the bind line in the frontend or listen section of your configuration.

    This points to the file containing a list of secret keys to use upon startup.

    frontend fe_main
       bind :80
       bind :443 ssl  crt /etc/hapee-1.9/certs/site.pem  tls-ticket-keys /etc/ssl/tls-ticket-keys/test.local.key
       http-request redirect scheme https unless { ssl_fc }
       default_backend webservers
  4. Call show tls-keys with no parameters to list all key files:

    $ echo "show tls-keys" | sudo socat stdio /var/run/hapee-1.9/hapee-lb.sock
    
    # id (file)
    0 (/etc/ssl/tls-ticket-keys/test.local.key)
  5. To view the keys in a file, call show tls-keys with the path to the file (or its numeric ID):

    $ echo "show tls-keys /etc/ssl/tls-ticket-keys/test.local.key" | \
      sudo socat stdio /var/run/hapee-1.9/hapee-lb.sock
    
    # id secret
    # 0 (/etc/ssl/tls-ticket-keys/test.local.key)
    0.0 foNecGaN+zlgI3TlsT/pLJ9d7ZRoSZ2nmXZq29BSRWIErYTwK1RfZs3XfImaruR8ovJ1lAmZxiE2+tHSwypa7Cqq01hczTn2EN1C3anecys=
    0.1 7VsH1P4H/N8MOLewQMOMOPjDa8ZCddHzLYe7JH/ydhg8JIO8yf1rg7JqAUbN2WoTzFlY0MhQKQSibARLQk1Ff0Ki12dma1/L7/W5xtgQANQ=
    0.2 BiSBxvngSPguqzteXXxCk8WrnimwCSuOapx4koBv01Bei8N00HuJIBce8w324xsYhiUpxcF4RbR6nGoMXOf1LkboQykFPnohTYOgfy4SPFE=

See also


Next up

shutdown frontend