Bon, ça fait plusieurs jours que j'essaie de faire marcher let's encrypt avec haproxy et j'y arrive pas
Je suis le tuto dédié : https://www.haproxy.com/blog/haproxy-and-let-s-encrypt
J'ai donc la config attachée au post (qui ne fait rien d'autre que renvoyer mon thumbprint acme si le chemin demandé contient '/.well-known/acme-challenge')
En http classique ça fonctionne nickel : si je curl sur http://domaine/.well-known/acme-challenge/aeiou il me renvoie aeiou.thumbprint ce qui est ce qu'il faut
Par contre dès que je curl en https j'ai droit à OpenSSL/3.0.13: error:0A000458:SSL routines::tlsv1 unrecognized name
Aidez moi s'il vous plait il fait trop chaud
#haproxy #LetsEncrypt

What I wanted to do:
Move this mastodon instance from its current datacenter location to my homelab.

What I did:
Update all my #proxmox nodes to the latest release, remove #haproxy and #acme packages from #pfsense in favour of a dedicated machine handling it.

That machine, however, still needs an ansible role and playbook to be written, in order to set it up

Let's gooooo!

Uff! #OpenSSL has really gone down the hill :

“The State of SSL Stacks”, HAProxy (https://www.haproxy.com/blog/state-of-ssl-stacks).

Via HN: https://news.ycombinator.com/item?id=43912164

On Lobsters: https://lobste.rs/s/bqnktb/state_ssl_stacks

@dvl Hi! Thanks for your blog post https://dan.langille.org/2025/05/03/implement-anubis-to-give-the-bots-a-harder-time/

I find it very useful.

Same DNS name for multiple application servers with replication or load balancers or making a service highly available?

https://serverfault.com/questions/1184781/same-dns-name-for-multiple-application-servers-with-replication-or-load-balancer

Same DNS name for multiple application servers with replication or load balancers or making a service highly available?

#spiceworks #dns #nginx #haproxy #loadbalancing #roundrobin #replication #question #it #networking

https://community.spiceworks.com/t/same-dns-name-for-multiple-application-servers-with-replication-or-load-balancers-or-making-a-service-highly-available/1210353

https://www.mail-archive.com/haproxy@formilux.org/msg45917.html #HAProxy 3.2.0 was released, featuring an experimental ACME client, real QUIC support for OpenSSL 3.5 and a lot of other stuff.

Did a quick writeup of how I use #anubis behind #haproxy in my #homelab.

https://mktbs.net/blog/2025/05/19/running-anubis-behind-haproxy/

Thanks to @cadey for the project. Support them!

In case you're interested in running a bleeding edge #reverseproxy with an optimized #SSL library: read this blog post (of mine) on "Compiling HAProxy with WolfSSL":

https://www.devxy.io/blog/haproxy-with-wolfssl/

Neskutečná haluz: Na ssl terminaci používám #haproxy s konfigurací:

frontend https
bind *:443 ssl crt /etc/haproxy/ssl/__fallback.pem crt /etc/haproxy/ssl

kam prostřednictvím skriptu https://github.com/VitexSoftware/certbot-haproxy/blob/develop/certbot-haproxy-deploy

hrnu výslednou kombinaci privkey + fullchain .pem

A co se nestalo, jedna doména jako na potvoru ať jsem dělal co jsem dělal měla sice na disku čerstvý certifikát, ale v #https byl expirovaný ....

Po X hodinách zoufalého laborování, reloadování a restartování a vzniku skriptu https://github.com/VitexSoftware/certbot-haproxy/blob/develop/check-haproxy-certs.sh jsem se nasral a celé to rebootnul ...

A server nejenže potom nabootoval, ale dokonce začal posílat správný certifikát ...

Kde to sakra mohlo být zastydlé, že nepomohl ani stop a start haproxy démona ? To mi hlava nebere :(

filesystém je normální /dev/sda2 on / type ext4 (rw,noatime) - m2 terová karta přes JMS583Gen 2 to PCIe Gen3x2 Bridge do USB a zbytek HW je #RPi5 s 8Gb ram

před rebootem jsem koukal i na výpis dmesg a žádné problémy s filesystémem nebo usb jsem tam neviděl

Dans ce (long et très détaillé) article sur l’état des stacks SSL, l’équipe de #haproxy (confirmée par d’autres équipes telles que Curl, Akamai, Microsoft…) tacle lourdement #OpenSSL sur la qualité du code et surtout sur la gouvernance du projet. Ça pique.
https://www.haproxy.com/blog/state-of-ssl-stacks

Long, but great read from #HAProxy on the state of #TLS libraries. Includes some scathing remarks about the #OpenSSL project.

“The development team has degraded their project’s quality, failed to address ongoing issues, and consistently dismissed widespread community requests for even minor improvements.”

“This unfortunate situation considerably hurts QUIC protocol adoption. It even makes it difficult to develop or build test tools to monitor a QUIC server.”

“When some of the project members considered a 32% performance regression ‘pretty near’ the original performance, it signaled to our development team that any meaningful improvement was unlikely.”

“In blunt terms: running OpenSSL 3.0.2 as shipped with Ubuntu 22.04 results in 1/100 of #WolfSSL’s performance on identical hardware! To put this into perspective, you would have to deploy 100 times the number of machines to handle the same traffic, solely because of the underlying SSL library.”

https://infosec.exchange/@0xabad1dea/114466046966536049

“AWS-LC looks like a very active project with a strong community. […] Even the recently reported performance issue was quickly fixed and released with the next version. […] This is definitely a library that anyone interested in the topic should monitor.”

#OpenSSL #BoringSSL #WolfSSL #AWSLC #HAProxy #OpenSource #FreeSoftware #FOSS #OSS #TLS #QUIC
https://www.haproxy.com/blog/state-of-ssl-stacks

Did some configuration improvements in #pfSense and now I just have one certificate to cover all of my subdomains. It required a modification to a sh file because #Porkbun changed their API URL. But now it's all working and it should update the certificate automatically.