Fabio -> HTTPS -> Service ?

[BogetC]

Hi !
I need to have 100% secure comunications.
Is it possible to forward request to backends with HTTPS ?

and also, is fabio still maintain

[magiconair]

You can use the tcp+sni proxy mode to have full end-to-end encryption. Yes, fabio is still maintained. However, I am currently relocating my family to another country which uses up a lot of my free time. — Frank Schröder

…

On 31. May 2018, at 16:37, BogetC ***@***.***> wrote: Hi ! I need to have 100% secure comunications. Is it possible to forward request to backends with HTTPS ? and also, is fabio still maintain — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[BogetC]

Thanks for this quick answer !

I will have a look at that. I'll keep you update.

Thanks again.

[BogetC]

Hi again !

I'm trying to store certificates in consul, and would like fabio to send the right certificate when a request is forwarded.
How tell fabio to pick the right certificates in consul to forward HTTPS request ? Is there a keyword to bind fabio and consul certificates ?

For now i'm only getting -> "http: proxy error: remote error: tls: bad certificate" whereas i'm sure that my certificate is all right.

My config is:

proxy.cs = cs=myCS;type=file;cert=/path/to/cert;key=/path/to/key
proxy.addr = :9999;proto=https;cs=myCS

My service tags are:

urlprefix-/A proto=https
urlprefix-/B proto=https
urlprefix-/C proto=https

[BogetC]

Am i force to use tcp+sni ?

I only want HTTPS protocol use between fabio and my service.
I really like fabio and it's the last thing i need to be sure my project will use fabio.
This is really easy to do with Go. So i think fabio is able to do that.

Is there a simple way to do that ?

[BogetC]

Ping.

Hello again.

I'm getting crazy. Fabio is great but for one last feature i need, i cannot move forward.

My services have to listen in https. Is there a way to configure fabio to send https request ?

tcp+sni proto seems to be to much constraint. i get : [WARN] No route for IP
tlsskipverify doesn't work for me. i get : tls: client didn't provide a certificate
and i get this last error with every config i try.

I think the documentation needs more examples.

[BogetC]

@magiconair I could need your help.
Sorry to spam this issue but there is not enought documentation and not enought place to talk about fabio.

[aaronhurt]

You basically have two options for end-to-end TLS communication:

1. tcp+sni listener will route to the desired backend based on the SNI header of the incoming request and do a simple TCP proxy. In this case fabio does not terminate TLS and leaves it up to the backend to terminate the TLS connection with the proper certificate chain.

2. https listener will route to the desired backend based on host, path or port just like a regular HTTP listener. In this case fabio will terminate the TLS connection and then re-originate optionally also https to a backend system.

[BogetC]

with https listener i get :

for my service : tls: client didn't provide a certificate

for fabio http: proxy error: remote error: tls: bad certificate

[aaronhurt]

To get mostly end-to-end TLS with an https type listener you should add the tags as described in the documentation to your backend services:

https://github.com/fabiolb/fabio/wiki/Features#https-upstream-support

Keep in mind the backend must support terminating HTTPS and provide proper certificates. You may skip validation if needed.

[BogetC]

done

[BogetC]

skip validation doesn't work

my service tags are : urlprefix-/A proto=https tlsskipverify=true

[BogetC]

even with that i get : tls: client didn't provide a certificate

[aaronhurt]

What does your routing table look like? Could you post the output of curl localhost:9998/api/routes?raw

[aaronhurt]

So, this seems like your backend isn't offering HTTPS or you are making an HTTPS request to an HTTP port.

[BogetC]

route add s2 /C https://137.74.25.188:8002 opts "tlsskipverify=true"
route add s1 /B https://137.74.25.192:8001
route add s2 /A https://137.74.25.188:8002 opts "tlsskipverify=true"
route add s1 /A https://137.74.25.192:8001