This topic describes how to configure SSL/TLS termination at HAProxy in VMware Tanzu Application Service for VMs (TAS for VMs) and Isolation Segment.

Overview

Both TAS for VMs and Isolation Segment include an HAProxy instance.

HAProxy is appropriate to use in a deployment when features are needed that are offered by HAProxy but are not offered by the Gorouters or IaaS-provided load balancers, such as with Azure load balancers. These include filtering of protected domains from trusted networks.

While HAProxy instances provide load balancing for the Gorouters, HAProxy is not itself highly available. For production environments, use a highly-available load balancer to scale HAProxy horizontally. The load balancer does not need to terminate TLS or even operate at Layer 7 (HTTP), as it can provide Layer 4 load balancing of TCP connections. Use of HAProxy does not remove the need for Gorouters. The Gorouter must always be deployed for HTTP apps, and the TCP router for non-HTTP apps.

You can generate a self-signed certificate for HAProxy if you do not want to obtain a signed certificate from a certificate authority (CA).

Terminate SSL/TLS at HAProxy

To configure SSL termination on HAProxy in TAS for VMs:

  1. Go to the Ops Manager Installation Dashboard.

  2. Click the TAS for VMs tile.

  3. Select Networking.

  4. Configure these fields based on the IaaS of your TAS for VMs deployment:

    If your TAS for VMs deployment is on: Then configure: See also:
    OpenStack or vSphere Decide whether you want your HAProxy to be highly available.
    • If you need highly available HAProxy:
      1. Choose an IP address for each HAProxy instance on the subnet where you deployed TAS for VMs.
      2. In the HAProxy IPs field of the Networking pane, enter the IP addresses you have selected for your HAProxy instances.
      3. Configure your load balancer, such as F5 or NSX, to forward domain names to the HAProxy IP addresses.
    • If you do not require high availability, such as if you are setting up a development environment:
      1. Skip setting up the load balancer.
      2. Choose one IP address for the single HAProxy instance.
      3. Configure DNS to point at the IP address. For more information, see How to Set Up DNS for HAProxy.
    		 For more information, see Configure Networking in Configuring TAS for VMs.
    AWS, GCP or Azure
    1. Leave the HAProxy IP address blank.
    2. In the Resource Config pane, locate the HAProxy job.
    3. In the Load Balancer column for the HAProxy job, specify the appropriate IaaS load balancer resource.
    		 For more information, see Configure Networking in Configuring TAS for VMs.

  5. In the Certificates and private keys for the Gorouter and HAProxy field, click the Add button to define at least one certificate keypair for the Gorouter and HAProxy. For each certificate keypair that you add, assign a name, enter the PEM-encoded certificate chain and PEM-encoded private key. You can either upload your own certificate or generate an RSA certificate in TAS for VMs. For options and instructions on creating a certificate for your wildcard domains, see Creating a Wildcard Certificate for TAS for VMs Deployments in Providing a Certificate for Your TLS Termination Point.

  6. In the Minimum version of TLS supported by the Gorouter and HAProxy, select the minimum version of TLS to use in HAProxy communications. HAProxy use TLS v1.2 by default. If you need to accommodate clients that use an older version of TLS, select a lower minimum version. For a list of TLS ciphers supported by the HAProxy, see TLS Cipher Suites in TLS Connections in Ops Manager.

  7. Under HAProxy forwards all requests to the Gorouter over TLS, leave Enable selected and provide the back end certificate authority.

  8. To use a specific set of TLS ciphers for HAProxy, configure TLS cipher suites for HAProxy. Enter an ordered, colon-separated list of TLS cipher suites in the OpenSSL format. For example, if you have selected support for an earlier version of TLS, enter cipher suites supported by this version. For a list of TLS ciphers supported by the HAProxy, see TLS Cipher Suites in TLS Connections in Ops Manager.

  9. If you expect requests larger than the default maximum of 16.384 KB, enter a new value in bytes for HAProxy request maximum buffer size. You may need to do this, for example, to support apps that embed a large cookie or query string values in headers.

  10. To force browsers to use HTTPS when making requests to HAProxy, select Enable in the HAProxy support for HSTS field and complete these optional configuration steps:

    • Maximum age in seconds for the HSTS request. HAProxy forces HTTPS requests from browsers for the duration of this setting. The maximum age is one year, or 31536000 seconds.
    • Enable the Include subdomains check box to force browsers to use HTTPS requests for all component subdomains.
    • Select the Enable preload check box to force instances of Google Chrome, Firefox, and Safari that access your HAProxy to refer to their built-in lists of known hosts that require HTTPS, of which HAProxy is one. This ensures that the first contact a browser has with your HAProxy is an HTTPS request, even if the browser has not yet received an HSTS header from HAProxy.

  11. (Optional) If you do not want the Gorouter to accept any non-encrypted HTTP traffic, select the Disable HTTP on the Gorouter and HAProxy check box.

  12. Under TLS termination point, select Infrastructure load balancer.

  13. (Optional) If your TAS for VMs deployment uses HAProxy and you want it to receive traffic only from specific sources, configure these fields:

    • HAProxy protected domains: Enter a comma-separated list of domains from which TAS for VMs can receive traffic.
    • (Optional) HAProxy trusted CIDRs: Enter a space-separated list of CIDRs to limit which IP addresses from the protected domains can send traffic to TAS for VMs.

  14. Click Save.

Set Up DNS for HAProxy

You only need to perform this procedure if you are using one instance of HAProxy such as in a development environment. If you would like HAProxy to be highly available, you must have a load balancer in front of it. In this case, you point DNS at the load balancer.

To use a single-instance HAProxy load balancer in a vSphere or OpenStack deployment:

  1. Create an A record in your DNS that points to the HAProxy IP address. The A record associates the System domain and Apps domain that you configure in the Domains pane of the Ops Manager tile with the HAProxy IP address.

    For example, with pcf.example.com as the main subdomain for your Ops Manager deployment and an HAProxy IP address 203.0.113.1, you must create an A record in your DNS that serves example.com and points *.pcf to 203.0.113.1.

    Name Type Data Domain
    *.pcf A 203.0.113.1 example.com

  2. To test your DNS entry, run:

    host

    The host command should return your HAProxy IP address.

check-circle-line exclamation-circle-line close-line
Scroll to top icon