Voir la source de Haproxy : Configuration de plusieurs certificats

=== Exemple de configuration ===
<syntaxhighlight lang="bash">
frontend http
    bind *:80

    filter cache mycache
    http-request cache-use mycache
    http-response cache-store mycache

    mode http
    option httplog

    http-request redirect scheme https code 301 unless { ssl_fc }

    acl yaka_acl  hdr(host)   www.yakakliker.org
    use_backend backend1 if yaka_acl

    acl openproject_acl  hdr(host)   openproject.yakakliker.org
    use_backend backend2 if openproject_acl 

    acl guacamole_acl hdr(host) guacamole.yakakliker.org
    use_backend backend3 if guacamole_acl


frontend https
    bind *:443 ssl crt /etc/haproxy/cert/www.yakakliker.org.pem crt /etc/haproxy/cert/openproject.yakakliker.org.pem

    filter cache mycache
    http-request cache-use mycache
    http-response cache-store mycache

    mode http
    option httplog

    http-request redirect scheme https code 301 unless { ssl_fc }

    acl yaka_acl  hdr(host)   www.yakakliker.org
    use_backend backend1 if yaka_acl

    acl openproject_acl  hdr(host)   openproject.yakakliker.org
    use_backend backend2 if openproject_acl




</syntaxhighlight><syntaxhighlight lang="bash">
backend backend1
    balance roundrobin
    mode http

    filter cache mycache
    http-request cache-use mycache
    http-response cache-store mycache


    option httpchk GET /
    default-server inter 3s fall 3 rise 2
    option forwardfor except 127.0.0.1
    http-request add-header X-Forwarded-Proto https if { ssl_fc }
    server web-server1  192.168.1.100:80 check
    server web-server2  192.168.2.100:80 check


backend backend2
    balance roundrobin
    mode http

    filter cache mycache
    http-request cache-use mycache
    http-response cache-store mycache

    option httpchk GET /
    default-server inter 3s fall 3 rise 2
    option forwardfor except 127.0.0.1
    http-request add-header X-Forwarded-Proto https if { ssl_fc }
    server web-server1  192.168.1.200:80 check
    server web-server2  192.168.2.200:80 check


backend backend3
    mode http
    balance source
    option httpchk GET /
    option forwardfor except 127.0.0.1
    http-request add-header X-Forwarded-Proto https if { ssl_fc }
    server web-server1  192.168.1.150:80 maxconn 32


</syntaxhighlight>

=== Test de la configuration ===
<syntaxhighlight lang="bash">
 haproxy -f /etc/haproxy/haproxy.cfg -c
</syntaxhighlight>

=== Création des certificats Let's encrypt pour HAproxy ===
<syntaxhighlight lang="bash">
cat fullchain.pem privkey.pem > example.com.pem
</syntaxhighlight>

=== Lien ===
https://docs.haproxy.org/

https://gist.github.com/urodoz/d7796cec6d47566439ba3d8ecce962f1

https://stackoverflow.com/questions/27947982/haproxy-unable-to-load-ssl-private-key-from-pem-file

[[Catégorie:Haproxy]]
[[Catégorie:SSL]]
[[Catégorie:Proxy]]


	‎<html>
<script src='https://storage.ko-fi.com/cdn/scripts/overlay-widget.js'></script>
<script>
  kofiWidgetOverlay.draw('yakakliker', {
    'type': 'floating-chat',
    'floating-chat.donateButton.text': 'Café',
    'floating-chat.donateButton.background-color': '#00b9fe',
    'floating-chat.donateButton.text-color': '#fff'
  });
</script>
		‎</html>

		‎<html>
<a href="https://www.compteurdevisite.com" title="compteur web gratuit sans pub"><img src="https://counter6.optistats.ovh/private/compteurdevisite.php?c=b4epghealnwlf7wuq7gn3ygll9aywrfx" border="0" title="compteur web gratuit sans pub" alt="compteur web gratuit sans pub"></a>
		‎</html>