You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 4 Next »

This page gives an outline of how to build HAProxy with OpenSSL so it can use TLS v1.3 (at the time of writing still an IETF draft). Since the draft is still a work in progress as is the implementation of TLS 1.3 some stability issues should be expected. It assumes Ubuntu 16.04 as the platform. 

Build Openssl

In order to have TLS 1.3 support you will need to grab a development version of OpenSSL (i.e. 1.1.1) . The instructions below use the master branch (at commit 3e524bf2d1748), it might be worth checking the OpenSSL repo for more stable branches of 1.1.1, or ones called "tls1.3-draft-XX".

These instructions build OpenSSL into a directory /opt/openssl-master to ensure that it's separate to any other OpenSSL installs on the machine.

Build OpenSSL
git clone git://git.openssl.org/openssl.git
cd openssl
./config --prefix=/opt/openssl-master --openssldir=/opt/openssl-master enable-tls1_3
make
sudo make install_sw

Build HAProxy

You need HAProxy 1.8.1 or later to enable TLS 1.3 support. We are using 1.8.3.

Build haproxy
sudo apt install build-essential libpcre2-dev zlib1g-dev


wget http://www.haproxy.org/download/1.8/src/haproxy-1.8.3.tar.gz
tar -xzf haproxy-1.8.3.tar.gz
cd haproxy-1.8.3/
make TARGET=linux2628 CPU=native USE_PCRE2=1 USE_PCRE2_JIT=1 USE_OPENSSL=1 SSL_LIB=/opt/openssl-master/lib SSL_INC=/opt/openssl-master/include USE_ZLIB=1
sudo make install

Modify the HAProxy configuration

Add the following to the HAProxy config (Note the ssl-default-bind-ciphers and ssl-default-bind-options lines), updating any paths as required.

If you only want TLSv1.3 with no fallback to TLSv1.2 then set ssl-default-bind-options to force-tlsv13

global
        log /dev/log    local0
        chroot /usr/local/var/lib/haproxy
        user haproxy
        group haproxy
        maxconn  4000
        pidfile  /usr/local/var/run/haproxy.pid
        tune.ssl.default-dh-param  2048
        ssl-default-bind-ciphers TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:TLS13-CHACHA20-POLY1305-SHA256:EECDH+AESGCM:EECDH+CHACHA20
        ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11

        # Default SSL material locations
        ca-base /etc/ssl/certs
        crt-base /etc/ssl/private

defaults
        balance roundrobin
        timeout  http-request 10s
        timeout  queue 1m
        timeout  connect 10s
        timeout  client 1m
        timeout  server 1m
        timeout  check 10s

listen dns
        bind :::853 v4v6 tfo ssl crt /etc/certs/keycert.pem
        mode tcp
        server server1 127.0.0.1:9999

Note the keycert.pem file is the concatenation of  the certificate chain and key into one file which is what HAProxy requires.

Create required paths

The above configuration sets HAProxy to run chroot in a directory /usr/local/var/lib/haproxy. It's necessary to create this directory. OpenSSL also needs access to /dev/urandom and /dev/random in the chroot.

# mkdir -p /usr/local/var/lib/haproxy/dev
# cd /usr/local/var/lib/haproxy/dev
# mknod urandom c 1 9
# mknod random c 1 8
  • No labels