☰

haproxy 不提供憑證鏈

tag-icon • tag-icon ssl-certificate haproxy
haproxy 不提供憑證鏈

我們正在設定 haproxy 1.5.14 來為即將發布的大規模租戶應用程式執行 SSL 終止。該應用程式使用了數百個域名；大多數的憑證都是針對通配符。

我已將所有 *.pem 檔案放在一個目錄中，並使用以下綁定行將 haproxy 指向該目錄：

bind *:443 ssl crt /media/windowsshare/aleyant-fs/ssl/pem/

它運作得很好——瀏覽器使用 SNI 發送域名，haproxy 找到正確的證書，協商 TLS，然後 haproxy 將其傳遞到後端。太棒了...

……除了不使用中間證書。

我已按照指示進行操作這裡。每個 pem 檔案包含連接的私鑰、網域憑證和中間憑證。例如，這是 pem 檔案之一（私鑰被省略）：

Bag Attributes
    Microsoft Local Key set: <No Values>
    localKeyID: 01 00 00 00
    friendlyName: le-6636f293-52ab-4054-9479-d004fe39ca60
    Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider
Key Attributes
    X509v3 Key Usage: 10
-----BEGIN PRIVATE KEY-----
---------------OMITTED FOR SECURITY ------------
-----END PRIVATE KEY-----
Bag Attributes
    localKeyID: 01 00 00 00
    friendlyName: v6.pressero.com (Wildcard)
subject=/OU=Domain Control Validated/CN=*.v6.pressero.com
issuer=/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
-----BEGIN CERTIFICATE-----
MIIE3TCCA8WgAwIBAgISESHTmCuIWLtnW8IH/eJb79kQMA0GCSqGSIb3DQEBCwUA
....
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIETTCCAzWgAwIBAgILBAAAAAABRE7wNjEwDQYJKoZIhvcNAQELBQAwVzELMAkG
...
-----END CERTIFICATE-----

但是檢查 openssl，我發現 haproxy 沒有提供完整的鏈：

CONNECTED(00000003)
--- Certificate chain  0 s:/OU=Domain Control Validated/CN=*.abp-inc.com
i:/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
-----BEGIN CERTIFICATE----- 
MIIE0TCCA7mgAwIBAgISESHIIsDizkD1ipb3UIUxxmbbMA0GCSqGSIb3DQEBCwUA
....
-----END CERTIFICATE-----
--- 
Server certificate 
subject=/OU=Domain Control Validated/CN=*.abp-inc.com 
issuer=/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
--- 
No client certificate CA names sent 
Peer signing digest: SHA512 
Server Temp Key: ECDH, P-256, 256 bits
--- 
SSL handshake has read 1936 bytes and written 482 bytes
--- 
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-SHA256 
Server public key is 2048 bit 
Secure Renegotiation IS supported 
Compression: NONE 
Expansion: NONE 
No ALPN negotiated 
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-SHA256
    Session-ID: 6112D93EF9ABB9FC9286BA4D5761012208599691BFCF6258ECA6E03B25146F71
    Session-ID-ctx: 
    Master-Key: 400EF52DB453A3D4AB9BC00CDFD713B7298DE03F101F3646D95A6F3D7E78E4D8FD582688109AF3E8A7B957DE8F788D0A
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - f3 a9 9e 90 5d a1 b7 75-b7 ef db 10 92 ef 87 1f   ....]..u........
    0010 - 3d ff f1 17 e4 34 6f 72-c8 fe 2b d5 ca c0 4e 81   =....4or..+...N.
    0020 - f7 85 5b 6f 87 b0 51 47-d9 4a 2c 2a 0d 98 59 62   ..[o..QG.J,*..Yb
    0030 - ca ef dc cd 9e 09 43 dd-37 a9 8a a3 1a c3 f9 b1   ......C.7.......
    0040 - 9e e5 c6 99 b4 96 f0 4b-52 22 f8 db 17 50 9d 0a   .......KR"...P..
    0050 - 75 4d 33 f2 96 32 6d 67-b7 ec fc a6 c9 5e c9 1e   uM3..2mg.....^..
    0060 - 47 6c f0 69 61 5d 12 ed-9c 52 51 2e 5a f5 74 68   Gl.ia]...RQ.Z.th
    0070 - e7 17 9d ca 14 49 3e 84-c6 da 4a 8d 8b 18 f8 a4   .....I>...J.....
    0080 - ca 1b 3c 17 60 0d 42 15-48 55 64 74 79 12 8f 4d   ..<.`.B.HUdty..M
    0090 - 17 2f 28 d1 72 01 11 bc-e5 b3 02 0c da 47 1b 3b   ./(.r........G.;

    Start Time: 1444168700
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
--- 
HTTP/1.0 400 Bad request 
Cache-Control: no-cache 
Connection: close 
Content-Type: text/html

<html><body><h1>400 Bad request</h1> Your browser sent an invalid request. </body></html>

closed

任何建議將不勝感激。

答案1

我是一個傻瓜。我按照以下方法做對了這，但我一直在測試錯誤。我忘記了-servername的論點openssl s_client -connect ...。由於沒有 SNI 被送到 haproxy，它選擇了第一的它在目錄中找到了 PEM 文件，這是我的目錄不是新增了中間證書（尚未）。

相關內容