10.22.12.54 haproxy IP Address
10.22.12.55 Apache web IP address
fqdn hasan.example.com resolved in 10.22.12.54
In My haproxy config
global
log /dev/log local0
log /dev/log local1 notice
maxconn 100000
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd
listeners
stats timeout 30s
user haproxy
group haproxy
daemon
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
defaults
log global
mode tcp
maxconn 1000000
option httplog
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
frontend Front-"443"
bind *:443
mode tcp
use_backend hasan
backend hasan
mode tcp
option ssl-hello-chk
server hasan 10.22.12.55:443 send-proxy-v2
APACHE WEB CONFIG
<VirtualHost *:443>
ServerName hasan.example.com:443
DocumentRoot /var/www/html/
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel debug
SSLProxyEngine on
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite HIGH:3DES:!aNULL:!MD5:!SEED:!IDEA
SSLCertificateFile /etc/httpd/conf.d/ssl/cert.pem
SSLCertificateKeyFile /etc/httpd/conf.d/ssl/key.pem
LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
CustomLog "logs/ssl_access_hasan_log" combined
ErrorLog "logs/ssl_errors_hasan.log
</VirtualHost>
RemoteIPModule Configuration
RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxy 10.22.12.54
Note:
My certificate CN same in apache ServerName directive
My certificate and private key located in
haproxy: /etc/ssl/certs/ and /etc/ssl/private/
apache web: /etc/httpd/conf.d/ssl
In apache Log I observed
[Thu Aug 15 11:36:23.368657 2019] [ssl:info] [pid 4058] SSL Library Error: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol -- speaking not SSL to HTTPS port!? [Thu Aug 15 11:36:23.368660 2019] [ssl:info] [pid 4058] [client 10.22.12.54:41800] AH01998: Connection closed to child 2 with abortive shutdown (server hasan.example.com:443) [Thu Aug 15 11:36:24.704663 2019] [ssl:info] [pid 4056] [client 10.22.12.54:41804] AH01964: Connection to child 0 established (server hasan.example.com:443) [Thu Aug 15 11:36:24.704820 2019] [ssl:info] [pid 4056] [client 10.22.12.54:41804] AH02008: SSL library error 1 in handshake (server hasan.example.com:443) [Thu Aug 15 11:36:24.704840 2019] [ssl:info] [pid 4056] SSL Library Error: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol -- speaking not SSL to HTTPS port!?
NOTE:
Without send-proxy everything work properly.
But I need using
1) Using TCP mode in HAPROXY
2) send-proxy in HAPROXY BACKEND
3) RemoteIP module in Apache Web side
Latest version from Base CentOS 7 repo (when i use yum install httpd) can not understand "RemoteIPProxyProtocol On"
Same situation in the latest apt repository.
I resolve this issue when I **compiled apache httpd from source code **.