What we want to achieve
We want to be able to connect to services inside a private network using client certificates, in this example we will be connecting to Redis.
haproxy-client-certs-overview.png
Install or compile Haproxy
I am using Debian, so this is what I use to compile Haproxy for testing out this setup.
Install and configure firewall
I am testing with a Redis-server, but it can be anything. First firewall off everything except for port 22 (ssh) and port 88 (our external redis port):
Install Redis
Since Debian and Debian-related distros have the terrible idea that software need to run by default, you should now have a running redis-server on port 6379.
Generate certificates
This is just for testing, please use some better tooling like easy-rsa to manage your certificates:
Setup Haproxy server
This let Haproxy listen on port 88, and it will verify the connecting certificates, and if the authentication is succesful, it will forward the traffic to redis on 127.0.0.1:6379.
Create a file named: haproxy_server.cfg:
Run the config in a non-daemonized way:
haproxy -f haproxy_server.cfg.
Connecting to Redis through another Haproxy
Create a file named: haproxy_client.cfg:
Run the config in a non-daemonized way:
haproxy -f haproxy_client.cfg.
Now you should be able to connect to Redis from your terminal:
Connect to Redis through Ruby
If you do not want to install a Haproxy instance just to manage the client certificates, you can connect directly from your favorite programming language, here is an example on how to do it in Ruby:
Todo:
Consider using CRL-files for making your life easier, CRL stands for Client Revocation List, and it is a list of certificates that you no longer trust for one reason or another, so if a server gets hacked, or an employee laptop goes missing, you can revoke the certificate and sleep nicely afterwards knowing that they can’t use the certificate for anything.
When you have a crl-file, It is as easy as adding crl-file <crlfile> to the server configuration.
There is a nice article about crls here: https://jamielinux.com/docs/openssl-certificate-authority/certificate-revocation-lists.html
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.