TLS termination behind AWS ELB on HAProxy (tcp mode)

Question

I am using AWS ELB as entry point (in Proxy mode) to load balance among 2 HAProxy-es behind it from where traffic goes further to MQTT broker.

1. Those 2 HAProxies are responsible for client TLS termination (2 way TLS).

2. Certificates kind of work. I've tested on local setup between 2 servers. I've been able to publish with 2-way TLS, properly terminate it, and publish message to mqtt. Problem arise when moving everything to AWS.

3. I am using self signed root CA, intermediate CA, server certificate and client certificates. Using Elliptic Curve...

4. Problem might be due to a servers CN. I think it has to be the same as hostname connecting to with tools like mosquitto_pub.

5. Error that I get is TLS error, whith debug -> ssl handshake failure. Somehow I am not able to produce more verbose errors. Using openssl with s_client and debug for max debug output. Which produce me ssl handshake failure.

I would really appreciate any hint/suggestion.

Thanks in advance.

Tomaz

Answer 1

I solved this by using subjectAltName feature. I edited openssl.cnf and add new section [alt_names] and reference it later on in configuration. Under alt_names I added 1 DNS key, and 2 IPs. Found with man x509v3_config.

Best, Tomaz