HAProxy frontend is randomly mixing

[Neubauer_L]

Hey there,

I'm having a OPNsense with HAProxy and Let's Encrypt configured.

The problem is, that if i configure a second Domain to my HAProxy it's like round robin my frontents while starting HAProxy.

For Example.
Frontent for Domain Skullbro.de is active and Frontent for l-neubauer.de is active.
Now if I hit "Apply" HAProxy only uses the Skullbro.de frontent even though I'm connecting to l-neubauer.de. Thus I'm getting a Certificate warning.
If I hit "Apply " again it's vice versa... Now Skullbro.de get's the Certificate error because the frontent for l-neubauer.de is used... and l-neubauer.de does not get any errors.

Forwarding to the webserver is working properly.
In the Logs you can find as attachment, there is a SSL handshake failure as expected because it's the wrong certificate for the domain.


My configuration looks like this:

I'm having a condition for each Domain. They all look like this:

Name: <domain name> wildcard http
Condition type: Host contains
Host Contains: <domain name>

Name: <domain name> wildcard https
Condition type: Host contains
Host Contains: <domain name>


Also I have a HTTP and HTTPS condition
Their conditions look like this:

HTTP: Traffic is HTTP
HTTPS: Traffic is SSL (TCP request content inspection)

My frontents are also kept seperate for http and https.
They look like this:

HTTP:
Name: <domain name>_frontent_http
Listen Addresses: <domain name>:80, <www.domain name>:80
Type: HTTP/HTTPS (default)
Default Backend Pool: websrv01_http
HTTP/2 Disabled
Basic Authentication Disabled
Rules: <domain name> wildcard http, redirect_acme_challenges


HTTPS:
Name: <domain name>_frontent_https
Listen Addresses: <domain name>:443, <www.domain name>:443
Type: HTTP/HTTPS (default)
Default Backend Pool: websrv01_https
Enable SSL Offloading: true
Certificates: Let's Encrypt Certificate (working als valid)
Default  certificate: Let's Encrypt Certificate (working als valid)
Client Certificate Auth: Disabled
HTTP/2: Disabled
Basic Authentication Disabled
Rules: <domain name> wildcard https, redirect_acme_challenges


My backend Pool server:

HTTP:
Name: websrv01_http
Mode: HTTP (Layer 7)
Servers: websrv01_80
(Every thing else is default)

HTTPS:
Name: websrv01_https
Mode: HTTP (Layer 7)
Servers: websrv01_443
(Every thing else is default)

My real servers:

HTTP:
Name: websrv01_80
IP: 10.12.10.10
Port 80
Mode: active

HTTPS:
Name: websrv01_443
IP: 10.12.10.10
Port: 443
Mode: active
SSL: Enabled


Thanks ahead for your time and help.

[francesco_lo]

Hi Neubauer_L,
I've exactly the same problem like you.
Did you found any solution for that?

Greetings
Frank