Haproxy SSL termination for postgres
I've got a postgresql + patroni cluster managed by HAProxy with configuration looking something like this
listen postgres
mode tcp
bind *:5432
option httpchk
http-check expect status 200
server node1 172.28.1.1:5432 maxconn 100 check port 8008
server node2 172.28.1.2:5432 maxconn 100 check port 8008
This works fine and I am able to connect to the master postgres instance using the haproxy frontend address.
I've then generated a self-signed ssl certificate using openssl and set on the binding like this:
bind *:5432 ssl crt /etc/ssl/private/server.pem
however I am not able to connect to the postgres server (HAProxy frontend) via PgAdmin. I have added the certificate and key to the server settings in PgAdmin but I get the Server closed the connection unexpectedly error. Am I doing something wrong or does this mean that I cannot have SSL termination for postgres?
postgresql ssl haproxy
asked Nov 11 at 17:33
MrPlow
51611536
add a comment |
I've got a postgresql + patroni cluster managed by HAProxy with configuration looking something like this
listen postgres
mode tcp
bind *:5432
option httpchk
http-check expect status 200
server node1 172.28.1.1:5432 maxconn 100 check port 8008
server node2 172.28.1.2:5432 maxconn 100 check port 8008
This works fine and I am able to connect to the master postgres instance using the haproxy frontend address.
I've then generated a self-signed ssl certificate using openssl and set on the binding like this:
bind *:5432 ssl crt /etc/ssl/private/server.pem
however I am not able to connect to the postgres server (HAProxy frontend) via PgAdmin. I have added the certificate and key to the server settings in PgAdmin but I get the Server closed the connection unexpectedly error. Am I doing something wrong or does this mean that I cannot have SSL termination for postgres?
postgresql ssl haproxy
asked Nov 11 at 17:33
MrPlow
51611536
1
This is not possible I think, you need to configure postgresql server to accept SSL connections, more here - postgresql.org/docs/9.5/ssl-tcp.html
– Mahesh H Viraktamath
Nov 12 at 9:32
add a comment |
I've got a postgresql + patroni cluster managed by HAProxy with configuration looking something like this
listen postgres
mode tcp
bind *:5432
option httpchk
http-check expect status 200
server node1 172.28.1.1:5432 maxconn 100 check port 8008
server node2 172.28.1.2:5432 maxconn 100 check port 8008
This works fine and I am able to connect to the master postgres instance using the haproxy frontend address.
I've then generated a self-signed ssl certificate using openssl and set on the binding like this:
bind *:5432 ssl crt /etc/ssl/private/server.pem
however I am not able to connect to the postgres server (HAProxy frontend) via PgAdmin. I have added the certificate and key to the server settings in PgAdmin but I get the Server closed the connection unexpectedly error. Am I doing something wrong or does this mean that I cannot have SSL termination for postgres?
postgresql ssl haproxy
asked Nov 11 at 17:33
MrPlow
51611536
I've got a postgresql + patroni cluster managed by HAProxy with configuration looking something like this
listen postgres
mode tcp
bind *:5432
option httpchk
http-check expect status 200
server node1 172.28.1.1:5432 maxconn 100 check port 8008
server node2 172.28.1.2:5432 maxconn 100 check port 8008
This works fine and I am able to connect to the master postgres instance using the haproxy frontend address.
I've then generated a self-signed ssl certificate using openssl and set on the binding like this:
bind *:5432 ssl crt /etc/ssl/private/server.pem
however I am not able to connect to the postgres server (HAProxy frontend) via PgAdmin. I have added the certificate and key to the server settings in PgAdmin but I get the Server closed the connection unexpectedly error. Am I doing something wrong or does this mean that I cannot have SSL termination for postgres?
postgresql ssl haproxy
postgresql ssl haproxy
asked Nov 11 at 17:33
MrPlow
51611536
asked Nov 11 at 17:33
MrPlow
51611536
asked Nov 11 at 17:33
MrPlow
51611536
asked Nov 11 at 17:33
MrPlow
51611536
asked Nov 11 at 17:33
MrPlow
51611536
51611536
1
This is not possible I think, you need to configure postgresql server to accept SSL connections, more here - postgresql.org/docs/9.5/ssl-tcp.html
– Mahesh H Viraktamath
Nov 12 at 9:32
add a comment |
1
This is not possible I think, you need to configure postgresql server to accept SSL connections, more here - postgresql.org/docs/9.5/ssl-tcp.html
– Mahesh H Viraktamath
Nov 12 at 9:32
1
1
This is not possible I think, you need to configure postgresql server to accept SSL connections, more here - postgresql.org/docs/9.5/ssl-tcp.html
– Mahesh H Viraktamath
Nov 12 at 9:32
This is not possible I think, you need to configure postgresql server to accept SSL connections, more here - postgresql.org/docs/9.5/ssl-tcp.html
– Mahesh H Viraktamath
Nov 12 at 9:32
add a comment |
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53251369%2fhaproxy-ssl-termination-for-postgres%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53251369%2fhaproxy-ssl-termination-for-postgres%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
This is not possible I think, you need to configure postgresql server to accept SSL connections, more here - postgresql.org/docs/9.5/ssl-tcp.html
– Mahesh H Viraktamath
Nov 12 at 9:32