Hello,
Since I have upgrade my Chrome webbrowser (Version 68.x), I always have
a popup to choose the client certificat when reaching a HAProxy frontend.
After some tests, I only have this popup if :
- a "personal" certificate is stored on the webbrowser,
- and the bind instruction "verify" is set to "optional" or "required".
It seems to be possible to define different options according to the SNI
with the "crl-file" parameter. The documentation says :
This setting is only available when support for OpenSSL was built in. It
designates a list of PEM file with an optional ssl configuration and a SNI
filter per certificate, with the following format for each line :
<crtfile> [\[<sslbindconf> ...\]] [[!]<snifilter> ...]
sslbindconf support "npn
<https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#npn>", "alpn
<https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#alpn>",
"verify<https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#>",
"ca-file<https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#>",
"no-ca-names
<https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#no-ca-names>",
crl-file", "ecdhe
<https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#ecdhe>", "curves
<https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#curves>",
"ciphers<https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#>"
configuration. With BoringSSL
and Openssl >= 1.1.1
"ssl-min-ver<https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#>"
and
"ssl-max-ver<https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#>"
are also supported.
It override the configuration set in bind line for the certificate.
~~~~~~~~~~~~~~~~~~~~~~~~~~~
In my side, I try with the following configuration without success :
=> frontend :
bind 0.0.0.0:443 ssl crt-list /etc/haproxy/domain_crt_list
=> avec /etc/haproxy/domain_crt_list :
/etc/haproxy/domain-com.pem [verify optional] my.domain.com
/etc/haproxy/domain2-com.pem *.domain.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~
The certificate provided by the haproxy server is different according to
the SNI, but the "verify" option is not take in account.
Is it a known bug or is there a workaround ?
Best regards
--
*Jean-Baptiste Berthelin*
