Question

我正在RabbitMQ集群中使用两个节点。两者都启用了SSL。具有自签名证书。

Node1's IP : x.x.x.x
Node2's IP : y.y.y.y

我也有启用SSL的客户端。客户端与群集之间的直接通信运行良好。现在，我想在两者之间使用负载均衡器（HAProxy）。因此，我安装了HAproxy并将其配置为不使用SSL。现在情况如下：

RabbitMQ Cluster : SSL enabled
HAProxy Server : Not SSL enabled
RabbitMQ Java Client : SSL enabled

在这种情况下，也正在建立连接。正如我的SSL证书所述

DNS.1 = Node1
DNS.2 = Node2
DNS.3 = HAProxyServer
DNS.4 = localhost

我很困惑，当HAProxy服务器完全没有启用SSL时，客户端到群集之间的启用SSL的通信是如何发生的？

HAProxy服务器配置 ：

global
    log /dev/log    local0
    log /dev/log    local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

    # Default SSL material locations
    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    # Default ciphers to use on SSL-enabled listening sockets.
    # For more information, see ciphers(1SSL). This list is from:
    #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
    # An alternative list with additional directives can be obtained from
    #  https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
    ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
    ssl-default-bind-options no-sslv3

defaults
    balance roundrobin
    log global
    mode tcp
    option redispatch
    option httplog
    option dontlognull
    option forwardfor
    timeout connect 5000
    timeout client 50000
    timeout server 50000
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http

# Set up application listeners here.


listen http_bucky_frontend
  bind *:1880
  mode http
  default_backend http_bucky_backend
  option httpclose
  reqadd X-Forwarded-Proto:\ http

listen rabbitmq_frontend
  bind *:5671
  mode tcp
  default_backend rabbitmq_backend
  option tcplog

listen admin
  bind 127.0.0.1:22002
  mode http
  stats uri /


backend http_backend
  mode http
  server 0-http_backend x.x.x.x:15761 maxconn 100 check
  server 1-http_backend y.y.y.y:15761 maxconn 100 check

backend http_bucky_backend
  mode http
  option httpchk GET /status
  http-check expect string up
  server 0-http_bucky_backend x.x.x.x:15761 maxconn 100 check
  server 1-http_bucky_backend y.y.y.y:15761 maxconn 100 check

backend rabbitmq_backend
  balance roundrobin
  mode tcp
  server 0-rabbitmq_backend x.x.x.x:5671 maxconn 4000 check
  server 1-rabbitmq_backend y.y.y.y:5671 maxconn 4000 check

使用HAProxy时，如何与启用SSL的RabbitMQ服务器与客户端进行通信？

0 个答案: