Software-Based Clustering [Ubuntu 12.04]

[Manuel Haim]

Hi Jarno,

On 09.07.2015 12:36 Jarno Huuskonen wrote:
> You'll probably also need to ignore client certificate verification errors
> on port 8443 (if SP's can use for example self signed certs in
> metadata).
> (http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#5.1-verify)
> 
> bind *:8443 ssl verify optional crt-ignore-err 18,19,20,21,27 ca-ignore-err 18,19,20,21,27
> AFAIK ignoring these verfication errors is same as
> optional_no_ca in mod_ssl and ssl_verify_client optional_no_ca; in
> nginx (the 18,19... error codes are in openssl x509_vfy.h).

I just wanted to say thanks again for your hints regarding HAproxy!


Some notes to people also using HAproxy on the IdP side:

Today, I had some trouble with an SP which relied on the Artifact
profile for SLO, raising an "SSL client certificate not trusted" in the
haproxy.log for port 8443 (even though the above OpenSSL error codes
were ignored in my haproxy.cfg).


The corresponding SP error log reads like this:

2017-08-29 12:45:26 ERROR Shibboleth.ArtifactResolver [7]: exception
resolving SAML 2.0 artifact: CURLSOAPTransport failed while contacting
SOAP endpoint
(https://sp.example.org:8443/idp/profile/SAML2/SOAP/ArtifactResolution):
error:14094413:SSL routines:ssl3_read_bytes:sslv3 alert unsupported
certificate


However, instead of looking for the specific OpenSSL error code to
ignore additionally in haproxy.cfg, I just decided to ignore all OpenSSL
error codes (and just leave the client cert verification to the IdP)
which works fine for me:

bind *:8443 ssl no-sslv3 verify optional crt-ignore-err all
ca-ignore-err all crt /path/to/cert.pem ca-file /path/to/ca.pem

Kind regards,
Manuel