How to Configure HAProxy with Mutual TLS Authentication

As a server administrator, you may have encountered the need for a reliable and secure method to balance network load and ensure encrypted communication between your web servers.

This is where HAProxy, a high-performance and highly-robust TCP/HTTP load balancer, comes into play. However, the challenge often lies in configuring HAProxy with Mutual TLS Authentication, a security protocol that enhances the security of your server communications.

This tutorial will guide you through the process of configuring HAProxy with Mutual TLS Authentication on your web server. Whether you’re using a dedicated, VPS, or cloud hosting machine, this guide will be applicable.

By following this guide, you will not only ensure secure communication between your servers but also optimize your server’s performance. Mutual TLS Authentication provides an extra layer of security, ensuring that both client and server verify each other’s identities before any communication takes place. This reduces the risk of data breaches and unauthorized access.

Let’s get started.

Step 1: Install HAProxy

The first step in configuring HAProxy with Mutual TLS Authentication is to install HAProxy on your server. You can do this by using the package manager of your operating system. For example, on a Ubuntu server, you would use the following command:

sudo apt-get install haproxy

This command installs HAProxy and all its dependencies on your server.

Step 2: Generate Certificates

In order to establish a secure connection using Mutual TLS Authentication, both the client and the server need to have their own certificates. These certificates serve as digital passports, providing a means for the client and server to verify each other’s identities. OpenSSL, a robust, full-featured open-source toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, is commonly used to generate these certificates.

Let’s start with generating a certificate for the server. You can do this by running the following command in your server’s command line:

openssl req -x509 -newkey rsa:4096 -keyout server_key.pem -out server_cert.pem -days 365

This command does a few things:

• openssl req: This initiates the creation of a certificate signing request (CSR), which is used to apply for a certificate from a certificate authority (CA). However, because we’re using the -x509 option, OpenSSL will create a self-signed certificate instead.
• -x509: This option tells OpenSSL to create a self-signed certificate instead of a CSR. This is suitable for situations where you don’t need a certificate from a CA, such as testing or internal use.
• -newkey rsa:4096: This creates a new RSA key that is 4096 bits long. RSA is a popular algorithm used in public key cryptography.
• -keyout server_key.pem: This specifies the filename to write the newly created private key to.
• -out server_cert.pem: This specifies the filename to write the newly created certificate to.
• -days 365: This sets the validity of the certificate to 365 days. After this period, the certificate will expire and a new one will need to be generated.

After running this command, you’ll be asked to enter a passphrase for the private key and to provide some information for your certificate. The information you provide will be embedded in the certificate and will be displayed when the certificate is viewed.

You will need to repeat this process to generate a certificate for the client. Simply replace server_key.pem and server_cert.pem with client_key.pem and client_cert.pem respectively in the command above.

Remember to keep your private keys (server_key.pem and client_key.pem) secure, as anyone with access to these can impersonate your server or client. The certificates (server_cert.pem and client_cert.pem), on the other hand, can be freely distributed as they only contain the public key and certificate information.

Step 3: Configure HAProxy

After successfully installing HAProxy and generating the necessary certificates, the next step is to configure HAProxy to use these certificates for Mutual TLS Authentication. This is done by editing the HAProxy configuration file. The default location of this file is /etc/haproxy/haproxy.cfg, but it may vary depending on your installation.

The configuration file is where you specify various settings for HAProxy, including which ports to listen on, which servers to forward requests to, and in our case, the paths to the server’s certificate and key. Additionally, we will enable Mutual TLS Authentication in this file.

Here is an example of what the configuration for Mutual TLS Authentication might look like:

frontend www
    bind *:443 ssl crt /etc/haproxy/server_cert.pem ca-file /etc/haproxy/client_cert.pem verify required
    default_backend app

Let’s break down what each line in this configuration does:

• frontend www: This line defines a new frontend named “www”. A frontend is where HAProxy listens for connections. All the following lines until the next frontend or backend keyword apply to this frontend.
• bind *:443 ssl crt /etc/haproxy/server_cert.pem ca-file /etc/haproxy/client_cert.pem verify required: This line tells HAProxy to listen on all interfaces (*) on port 443 (443) for SSL (ssl) connections. It also specifies the path to the server’s certificate (crt /etc/haproxy/server_cert.pem) and the path to the client’s certificate (ca-file /etc/haproxy/client_cert.pem). The verify required part tells HAProxy to require a valid client certificate for all incoming connections.
• default_backend app: This line tells HAProxy to forward all requests that reach this frontend to the backend named “app”. A backend is a set of servers that HAProxy forwards requests to.

Remember to replace /etc/haproxy/server_cert.pem and /etc/haproxy/client_cert.pem with the actual paths to your server and client certificates.

After editing the configuration file, save your changes and exit the text editor. You will then need to restart HAProxy for the changes to take effect. You can do this with the following command:

sudo systemctl restart haproxy

This command tells the system to restart the HAProxy service. After running this command, HAProxy should start using Mutual TLS Authentication for all incoming connections.

Step 4: Test the Configuration

Once you have configured HAProxy for Mutual TLS Authentication, it’s crucial to test the configuration to ensure that everything is working as expected. This involves restarting HAProxy and then attempting to connect to the server using a client that has the correct certificate.

To restart HAProxy, you can use the following command:

sudo systemctl restart haproxy

This command tells the system to restart the HAProxy service. After running this command, HAProxy should start using the new configuration.

Next, you’ll want to test the connection from a client that has the correct certificate. You can do this using a tool like curl, which is a command-line tool for making HTTP requests. Here’s an example command:

curl https://yourserver.com --cert /path/to/client_cert.pem --key /path/to/client_key.pem

This command does a few things:

• curl https://yourserver.com: This tells curl to make a request to your server. Replace yourserver.com with the actual domain or IP address of your server.
• –cert /path/to/client_cert.pem: This option tells curl to use the specified client certificate when making the request. Replace /path/to/client_cert.pem with the actual path to your client certificate.
• –key /path/to/client_key.pem: This option tells curl to use the specified private key when making the request. Replace /path/to/client_key.pem with the actual path to your client’s private key.

If the connection is successful, curl will display the content of the server’s response. This means that you have successfully configured HAProxy with Mutual TLS Authentication. If the connection is not successful, curl will display an error message, which can help you diagnose any issues with your configuration.

Commands Mentioned:

• sudo apt-get install haproxy – Installs HAProxy on your server.
• openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 – Generates a new RSA key and a self-signed certificate.
• sudo service haproxy restart – Restarts HAProxy.
• curl https://yourserver.com –cert client.pem –key client.key – Tests the connection to your server using the specified client certificate and key.

Conclusion

In this tutorial, we’ve walked through the process of configuring HAProxy with Mutual TLS Authentication on your web server. By following these steps, you can enhance the security of your server communications and ensure that both client and server verify each other’s identities before any communication takes place.

We started by installing HAProxy on your server, followed by generating the necessary certificates for both the client and the server. We then configured HAProxy to use these certificates for Mutual TLS Authentication and tested the configuration to ensure everything was working as expected.

By implementing Mutual TLS Authentication, you’re adding an extra layer of security to your server communications, reducing the risk of data breaches and unauthorized access. Whether you’re using a dedicated, VPS, or cloud hosting machine, this guide is applicable and will help you secure your server communications.

We hope this guide has been helpful. If you have any questions or run into any issues, please leave a comment below. We’re here to help!

FAQ

1. What is Mutual TLS Authentication?

   Mutual TLS Authentication is a security protocol where both client and server verify each other’s identities before any communication takes place. This is done using digital certificates, enhancing the security of server communications and reducing the risk of data breaches and unauthorized access.

2. Why is Mutual TLS Authentication important?

   Mutual TLS Authentication is important because it adds an extra layer of security to server communications. By ensuring that both client and server verify each other’s identities before any communication takes place, Mutual TLS Authentication reduces the risk of data breaches and unauthorized access.

3. What is HAProxy?

   HAProxy is a high-performance and highly-robust TCP/HTTP load balancer. It offers high availability, load balancing, and proxying for TCP and HTTP-based applications. HAProxy is particularly suited for very high traffic websites and is therefore often used to improve web service reliability and performance.

4. How do I install HAProxy?

   You can install HAProxy using the package manager of your operating system. For example, on a Ubuntu server, you would use the command ‘sudo apt-get install haproxy’ to install HAProxy and all its dependencies.

5. How do I generate certificates for Mutual TLS Authentication?

   You can generate certificates for Mutual TLS Authentication using a tool like OpenSSL. The command ‘openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365’ generates a new RSA key and a self-signed certificate that is valid for 365 days. You will need to generate a certificate for both the client and the server.