Basic features : SSL

HAProxy's SSL stack is recognized as one of the most featureful according to Google's engineers (http://istlsfastyet.com/). The most commonly used features making it quite complete are :

  • SNI-based multi-hosting with no limit on sites count and focus on performance. At least one deployment is known for running 50000 domains with their respective certificates;

  • support for wildcard certificates reduces the need for many certificates ;

  • certificate-based client authentication with configurable policies on failure to present a valid certificate. This allows to present a different server farm to regenerate the client certificate for example;

  • authentication of the backend server ensures the backend server is the real one and not a man in the middle;

  • authentication with the backend server lets the backend server it's really the expected haproxy node that is connecting to it;

  • TLS NPN and ALPN extensions make it possible to reliably offload SPDY/HTTP2 connections and pass them in clear text to backend servers;

  • OCSP stapling further reduces first page load time by delivering inline an OCSP response when the client requests a Certificate Status Request;

  • Dynamic record sizing provides both high performance and low latency, and significantly reduces page load time by letting the browser start to fetch new objects while packets are still in flight;

  • permanent access to all relevant SSL/TLS layer information for logging, access control, reporting etc... These elements can be embedded into HTTP header or even as a PROXY protocol extension so that the offloaded server gets all the information it would have had if it performed the SSL termination itself.

  • Detect, log and block certain known attacks even on vulnerable SSL libs, such as the Heartbleed attack affecting certain versions of OpenSSL.

  • support for stateless session resumption (RFC 5077 TLS Ticket extension). TLS tickets can be updated from CLI which provides them means to implement Perfect Forward Secrecy by frequently rotating the tickets.

results matching ""

    No results matching ""