ca 自签名证书 并实现HAProxy https功能

　

mkdir /etc/ssl/xip.io
[root@ha02 haproxy-1.4.]# openssl genrsa -out /etc/ssl/xip.io/xip.io.key
Generating RSA private key,  bit long modulus
........++++++
...........++++++
e is  (0x10001)
[root@ha02 haproxy-1.4.]# openssl req -new -key /etc/ssl/xip.io/xip.io.key -out /etc/ssl/xip.io/xip.io.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name ( letter code) [XX]:CN　＃国家代码
State or Province Name (full name) []:china　#省
Locality Name (eg, city) [Default City]:beijing　#市
Organization Name (eg, company) [Default Company Ltd]:iseastar　#公司名称
Organizational Unit Name (eg, section) []:iseastar　#可以不写
Common Name (eg, your name or your server's hostname) []:iseastar #可以不写
Email Address []:     ＃邮箱地址

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

[root@ha02 haproxy-1.4.]# openssl x509 -req -days  -in /etc/ssl/xip.io/xip.io.csr -signkey /etc/ssl/xip.io/xip.io.key -out /etc/ssl/xip.io/xip.io.crt
Signature ok
subject=/C=CN/ST=china/L=beijing/O=iseastar/OU=iseastar/CN=iseastar
Getting Private key

这样就生成了下面的三个文件：

[root@ha02 haproxy-1.4.]# tree /etc/ssl/xip.io/
/etc/ssl/xip.io/
├── xip.io.crt
├── xip.io.csr
└── xip.io.key

 directories,  files

在创建了证书之后，我们需要创建pem文件。pem文件本质上只是将证书 密钥及证书中心证书（可有可无）拼接成一个文件。在我们在这里只是简单地将证书及密钥文以这个顺序拼接在起来创建xip.io.pen文件 。这就是HAProxy读取SSL证书首选的方式。

[root@ha02 haproxy-1.4.]# cat /etc/ssl/xip.io/xip.io.crt /etc/ssl/xip.io/xip.io.key |tree /etc/ssl/xip.io/xip.io.pem
/etc/ssl/xip.io/xip.io.pem [error opening dir]

 directories,  files
[root@ha02 haproxy-1.4.]# ls /etc/ssl/xip.io/
xip.io.crt  xip.io.csr  xip.io.key
有报错，并没有生成.pem结尾的文件

后来细心看一下一个命命看错了应该是tee而不是tree

[root@ha02 haproxy-1.4.]# cat /etc/ssl/xip.io/xip.io.crt /etc/ssl/xip.io/xip.io.key |tee /etc/ssl/xip.io/xip.io.pem
-----BEGIN CERTIFICATE-----
MIICRzCCAbACCQCp15MeAY6YFzANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJD
TjEOMAwGA1UECAwFY2hpbmExEDAOBgNVBAcMB2JlaWppbmcxETAPBgNVBAoMCGlz
ZWFzdGFyMREwDwYDVQQLDAhpc2Vhc3RhcjERMA8GA1UEAwwIaXNlYXN0YXIwHhcN
MTYxMjE2MDUxMzM5WhcNMTcxMjE2MDUxMzM5WjBoMQswCQYDVQQGEwJDTjEOMAwG
A1UECAwFY2hpbmExEDAOBgNVBAcMB2JlaWppbmcxETAPBgNVBAoMCGlzZWFzdGFy
MREwDwYDVQQLDAhpc2Vhc3RhcjERMA8GA1UEAwwIaXNlYXN0YXIwgZ8wDQYJKoZI
hvcNAQEBBQADgY0AMIGJAoGBANEKpgCx8Hd0J2gZd/YJRpqjac0nZNU29pyOpXbl
VxOy9tUR4bHX6y7IDW/G297orwc2AIGetNVSYEVKTh6pCZz6H/E+FZG7+A2ftJ8I
823Hx7iW10Q1sP95UsYB2N0wd5AtKfywuv3Bjwe2nQj3R47+LuwABNnXS0mYp93y
4EkxAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEABd+XL1YdowVUWivoxki751bAdqpv
L9WizV1LW0Whf4GWS10wnubXSOHqR3Ybcm9Nnq1adqoV1g8pcJMWGYk+JKjA+N+i
tiiBSwvKw7kEC3/r2EH0vmVtv4TLcohTJrIil2WslPYcHVcWJX/HdgBD5yhSNp4D
INwzh2GWxZ2HAE8=
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQDRCqYAsfB3dCdoGXf2CUaao2nNJ2TVNvacjqV25VcTsvbVEeGx
+suyA1vxtve6K8HNgCBnrTVUmBFSk4eqQmc+h/xPhWRu/gNn7SfCPNtx8e4ltdE
NbD/eVLGAdjdMHeQLSn8sLr9wY8Htp0I90eO/i7sAATZ10tJmKfd8uBJMQIDAQAB
AoGAc8J10wS2qS/FcrxH1hOk6ZV8zYL3L6tUPbYwovq1kc8VKUDRvu5W6n0WE8QH
lhU8d73L4fvFICyR600OnaP2EdtslR0BLwR0r55PMGxm6hpE5KI8N3nrxRQSkbPs
u8o9rS9IaWXjKk5gYcrTQTfGuaez4TzsUtQr/oVJfviZ25ECQQDxq/ZpTzbr6TFH
V+iLFI3dwz6wH72DTFPo5FrZ+s7VTuuYi8mb1LDxXFxWKCgaD1vAZf8hFddXthjA
20Kk7+DXAkEA3W9u7VWa6C85NbGQ6VH6AVSk9uDgzWafxWw0in3tdsV/VEZxu3PF
iXFHVHUhy4dc7UZksl7GACtkPiMV6iJ9NwJBAJpNZYNPpI1z0pbutfc3JG1XYAsr
+OCAN4MXajqLPMxNG3fGqO7qGh/BDOOluBULgVWSyhbhzyCdj6hzVlXhIvkCQF2k
mVGO6TKVfekiDXlOLJ7Rb+3jjc3vP1Pa/aEvvfODc+Rs4f326KvGFvc1jbQnq3nA
UidIgw1hTEQmzEa2jSMCQGDoM8ginUV7o33WcKLog5arhYFVOXuZi478GAhtauX9
Dcv8CRWpfdi3LuOM8yCRWDEyPfBw+3CfIBlXjVBkD7w=
-----END RSA PRIVATE KEY-----
[root@ha02 haproxy-1.4.]# tree /etc/ss
ssh/ ssl/
[root@ha02 haproxy-1.4.]# tree /etc/ssl/xip.io/
/etc/ssl/xip.io/
├── xip.io.crt
├── xip.io.csr
├── xip.io.key
└── xip.io.pem

 directories,  files

当购买真正的证书时，你不一定会获取并接后的文件。可能需要自己拼接生成，但也有机构提供拼接好的文件 给你。但可能不是pem文件，而是dundel ，cert， cert， key文件或一些相同概念但名称类似的文件。

pem文件是HAProxy只需简单配置就可以处理SSLL连接了。

要在HAProxy使用SSL连接 ，我们现在就可以添加校准SSL端口443的绑定，并让HAProxy知道SSL证书的位置 ：

         stats admin if TRUE                               |          stats admin if TRUE
          mode http                                         |          mode http
          #server sshd 192.168.1.104: check port  inter |          #server sshd 192.168.1.104: check port  inter
                                                            |
  frontend app01_www.app01.com:                         |  frontend app01_www.app01.com:
          bind *:                                       |          bind *:
          bind *: ssl crt /etc/ssl/xip.io/xip.io.pem     |  ---------------------------------------------------------
          timeout client 8h                                 |          timeout client 8h
          mode http                                         |          mode http
          default_backend server_app01                      |          default_backend server_app01
  backend server_app01                                      |  backend server_app01
          mode http                                         |          mode http
          timeout server 8h                                 |          timeout server 8h
          cookie SERVERID insert nocache                    |          cookie SERVERID insert nocache
          server app01 10.100.0.37: check port  rise|          server app01 10.100.0.37: check port  ris
  frontend app02_www.app02.com:                         |  frontend app02_www.app02.com:
          bind *:                                       |          bind *:
          bind *: ssl crt /etc/ssl/xip.io/xip.io.pem     |  ---------------------------------------------------------
          timeout client 8h                                 |          timeout client 8h
          mode http                                         |          mode http
          default_backend server_app02                      |          default_backend server_app02
  backend server_app02                                      |  backend server_app02
          mode http                                         |          mode http
          timeout server 8h                                 |          timeout server 8h
+ +--   lines: cookie SERVERID insert nocache--------------|+ +--   lines: cookie SERVERID insert nocache-------------

看看下在的改动只是加了一行代码：

 bind *: ssl crt /etc/ssl/xip.io/xip.io.pem 

上面的配置可以支持https也支持http

下面只支持https,看一下这三个文件的不同：

+ +--  lines: global--------------------------------------|+ +--  lines: global-------------------------------------
          mode http                                         |          mode http
          #server sshd 192.168.1.104: check port  inter |          #server sshd 192.168.1.104: check port  inter
                                                            |
  frontend app01_www.app01.com:                         |  frontend app01_www.app01.com:
          bind *:                                       |          bind *:
          bind *: ssl crt /etc/ssl/xip.io/xip.io.pem     |          bind *: ssl crt /etc/ssl/xip.io/xip.io.pem
          redirect scheme https if !{ ssl_fc }              |  ---------------------------------------------------------
          timeout client 8h                                 |          timeout client 8h
          mode http                                         |          mode http
          default_backend server_app01                      |          default_backend server_app01
  backend server_app01                                      |  backend server_app01
          mode http                                         |          mode http
          timeout server 8h                                 |          timeout server 8h
          cookie SERVERID insert nocache                    |          cookie SERVERID insert nocache
          server app01 10.100.0.37: check port  rise|          server app01 10.100.0.37: check port  ris
  frontend app02_www.app02.com:                         |  frontend app02_www.app02.com:
          bind *:                                       |          bind *:
          redirect scheme https if !{ ssl_fc }              |  ---------------------------------------------------------
          bind *: ssl crt /etc/ssl/xip.io/xip.io.pem     |          bind *: ssl crt /etc/ssl/xip.io/xip.io.pem
          timeout client 8h                                 |          timeout client 8h
          mode http                                         |          mode http
          default_backend server_app02                      |          default_backend server_app02
  backend server_app02                                      |  backend server_app02
          mode http                                         |          mode http
+ +--   lines: timeout server 8h---------------------------|+ +--   lines: timeout server 8h--------------------------

前左边的只支持https右边是支持https和http