https在haproxy背后不起作用

我必须将haproxy放在已经运行的Apache web服务器前面。haproxy和ApacheWeb服务器都位于单独的Cent-OS6.4机器上。 我已经安装了haproxy-1.5-dev19.el6.x86_64，它在http上运行良好，但是 以下是https错误：- “502坏网关：服务器返回无效或不完整的响应”

haproxy测井曲线如下所示：

Nov  7 05:49:56 localhost haproxy[9925]: XX.XX.XXX.XX:51949
[07/Nov/2013:05:49:55.204] https-in~ abc-https/server1
1595/0/1/-1/1597 502 714 - - PHNN 2/2/0/0/0 0/0 "GET / HTTP/1.1"

Nov  7 05:49:57 localhost haproxy[9925]: XX.XX.XXX.XX:51947
[07/Nov/2013:05:49:55.972] https-in~ abc-https/server1
1523/0/1/-1/1525 502 714 - - PHNN 1/1/0/0/0 0/0 "GET /favicon.ico HTTP/1.1"

Web服务器上的SSL日志（代理后的请求）：

Web服务器上的SSL日志（直接请求）：

正如您在webserver上看到的，代理和无代理之间的区别

下面是我的haproxy.cfg文件：

global
    log         127.0.0.1 local2
    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     40000
    user        haproxy
    group       haproxy
    daemon

    stats socket /var/lib/haproxy/stats

defaults
    mode                    http
    log                     global
    option                  httplog
    option                  dontlognull
    option http-server-close
    option forwardfor   
    option                  redispatch
    retries                 10
    timeout http-request    60s
    timeout queue           60s
    timeout connect         60s
    timeout client          60s
    timeout server          60s
    timeout http-keep-alive 60s
    timeout check           60s
    maxconn                 30000

Listen stats 0.0.0.:8880
    stats enable
    stats hide-version
    stats uri   /
    Stats realm HAProxy\ Statistics
    stats auth XXXXX:XXXXX

frontend http-in
    bind *:80
    acl url_static       path_beg       -i /static /images /javascript /stylesheets
    acl url_static       path_end       -i .jpg .gif .png .css .js
    tcp-request connection accept if { src -f /etc/haproxy/whitelist.lst } 
    tcp-request connection reject if { src_conn_cur ge 200 }   tcp-request
    connection track-sc1 src

    use_backend http-in-static if url_static
    default_backend           http-in-bk

frontend https-in
    bind *:443 ssl crt /home/ec2-user/ev/haproxy.pem
    http-request add-header X-Proto https if { ssl_fc }
    use_backend abc-https if {ssl_fc}

backend abc-https
    server server1 10.0.0.16:443 check 

backend http-in-static
     server static 10.0.0.16:80 check inter 100 weight 1

backend http-in-bk
    acl abuse src_http_err_rate(http-in) ge 100
    acl flag_abuser src_inc_gpc0(http-in)
    tcp-request content reject if abuse flag_abuser
    server  server1 10.0.0.16:80 check  inter 100 weight 1

只有一个Web服务器已经在运行，在此之前我必须实现haproxy

我哪里做错了？请帮我解决这个问题

问候,

---

Komal Pal

您正在解密SSL流量，然后将明文HTTP发送到Web服务器上的HTTPS套接字

在此设置中，您通常会将其发送到Web服务器上的端口80，因为您已经对其进行了解密

---

如果要重新加密，则必须更改“server xxx”行，使其上也有“ssl”标志

您的Web服务器后端abc https真的期望443吗？无论如何，HAProxy 1.5仍然是开发版本，不应该用于生产。现在你可以考虑使用HAXPROTER和Stimel.

XX.XX.XX.XX - - [06/Nov/2013:22:48:42 -0800] **"GET / HTTP/1.1"** 200 19553

global
    log         127.0.0.1 local2
    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     40000
    user        haproxy
    group       haproxy
    daemon

    stats socket /var/lib/haproxy/stats

defaults
    mode                    http
    log                     global
    option                  httplog
    option                  dontlognull
    option http-server-close
    option forwardfor   
    option                  redispatch
    retries                 10
    timeout http-request    60s
    timeout queue           60s
    timeout connect         60s
    timeout client          60s
    timeout server          60s
    timeout http-keep-alive 60s
    timeout check           60s
    maxconn                 30000

Listen stats 0.0.0.:8880
    stats enable
    stats hide-version
    stats uri   /
    Stats realm HAProxy\ Statistics
    stats auth XXXXX:XXXXX

frontend http-in
    bind *:80
    acl url_static       path_beg       -i /static /images /javascript /stylesheets
    acl url_static       path_end       -i .jpg .gif .png .css .js
    tcp-request connection accept if { src -f /etc/haproxy/whitelist.lst } 
    tcp-request connection reject if { src_conn_cur ge 200 }   tcp-request
    connection track-sc1 src

    use_backend http-in-static if url_static
    default_backend           http-in-bk

frontend https-in
    bind *:443 ssl crt /home/ec2-user/ev/haproxy.pem
    http-request add-header X-Proto https if { ssl_fc }
    use_backend abc-https if {ssl_fc}

backend abc-https
    server server1 10.0.0.16:443 check 

backend http-in-static
     server static 10.0.0.16:80 check inter 100 weight 1

backend http-in-bk
    acl abuse src_http_err_rate(http-in) ge 100
    acl flag_abuser src_inc_gpc0(http-in)
    tcp-request content reject if abuse flag_abuser
    server  server1 10.0.0.16:80 check  inter 100 weight 1