WSS Load Balancing with SSL Termination at layer 4Can Haproxy work with SSL if I use only roundrobin?Building an SSL server farmHow to horizontally scale SSL termination behind HAProxy load balancing?Possible for HAProxy to perform a mix of SSL termination and passthrough?Trying to setup transparent, load balancing, SSL reverse proxy. Is it possible?nginx SSL termination with sticky load balancingelb ssl termination for wss websocket fails net::ERR_RESPONSE_HEADERS_TRUNCATEDLoad balancing for many domains with TLS terminationBest way to manually switch between front end servers?TLS websocket proxy with deep packet inspection/traffic logging
Multi tool use
I want to know what marumaru means
Why does the hash of infinity have the digits of π?
Why would a rational buyer offer to buy with no conditions precedent?
Security vulnerabilities of POST over SSL
...And they were stumped for a long time
Is keeping the forking link on a true fork necessary (Github/GPL)?
Dad jokes are fun
Can a UK national work as a paid shop assistant in the USA?
Finding all files with a given extension whose base name is the name of the parent directory
Python program for fibonacci sequence using a recursive function
Of strange atmospheres - the survivable but unbreathable
Why is the Eisenstein ideal paper so great?
One word for 'the thing that attracts me'?
Is superuser the same as root?
Where is Jon going?
On San Andreas Speedruns, why do players blow up the Picador in the mission Ryder?
How can I properly write this equation in Latex?
Using too much dialogue?
What is the recommended procedure to land a taildragger in a crosswind?
Is it legal to have an abortion in another state or abroad?
What did the 'turbo' button actually do?
First Program Tic-Tac-Toe
Why is 'additive' EQ more difficult to use than 'subtractive'?
Is this homebrew "Cactus Grenade" cantrip balanced?
WSS Load Balancing with SSL Termination at layer 4
Can Haproxy work with SSL if I use only roundrobin?Building an SSL server farmHow to horizontally scale SSL termination behind HAProxy load balancing?Possible for HAProxy to perform a mix of SSL termination and passthrough?Trying to setup transparent, load balancing, SSL reverse proxy. Is it possible?nginx SSL termination with sticky load balancingelb ssl termination for wss websocket fails net::ERR_RESPONSE_HEADERS_TRUNCATEDLoad balancing for many domains with TLS terminationBest way to manually switch between front end servers?TLS websocket proxy with deep packet inspection/traffic logging
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
Should it be possible to terminate SSL for wss (secure websockets) at a layer 4 load balancer?
Seems to me that wss (and ws) in general would require TCP routing since an HTTP reverse proxy wouldn't be able to make sense of the packets; and, SSL termination would require layer 7 routing since the session is really maintained above layer 4. I feel somewhat confident about the first statement, and much less so about the second.
Bonus question. If it is possible, in general, to achieve wss routing and ssl termination in a single load balancer, can it be done specifically with HAProxy? Nginx? Other?
nginx ssl haproxy websocket wss
asked Jan 27 '17 at 20:28
rbinionrbinion
111
add a comment |
Should it be possible to terminate SSL for wss (secure websockets) at a layer 4 load balancer?
Seems to me that wss (and ws) in general would require TCP routing since an HTTP reverse proxy wouldn't be able to make sense of the packets; and, SSL termination would require layer 7 routing since the session is really maintained above layer 4. I feel somewhat confident about the first statement, and much less so about the second.
Bonus question. If it is possible, in general, to achieve wss routing and ssl termination in a single load balancer, can it be done specifically with HAProxy? Nginx? Other?
nginx ssl haproxy websocket wss
asked Jan 27 '17 at 20:28
rbinionrbinion
111
add a comment |
Should it be possible to terminate SSL for wss (secure websockets) at a layer 4 load balancer?
Seems to me that wss (and ws) in general would require TCP routing since an HTTP reverse proxy wouldn't be able to make sense of the packets; and, SSL termination would require layer 7 routing since the session is really maintained above layer 4. I feel somewhat confident about the first statement, and much less so about the second.
Bonus question. If it is possible, in general, to achieve wss routing and ssl termination in a single load balancer, can it be done specifically with HAProxy? Nginx? Other?
nginx ssl haproxy websocket wss
asked Jan 27 '17 at 20:28
rbinionrbinion
111
Should it be possible to terminate SSL for wss (secure websockets) at a layer 4 load balancer?
Seems to me that wss (and ws) in general would require TCP routing since an HTTP reverse proxy wouldn't be able to make sense of the packets; and, SSL termination would require layer 7 routing since the session is really maintained above layer 4. I feel somewhat confident about the first statement, and much less so about the second.
Bonus question. If it is possible, in general, to achieve wss routing and ssl termination in a single load balancer, can it be done specifically with HAProxy? Nginx? Other?
nginx ssl haproxy websocket wss
nginx ssl haproxy websocket wss
asked Jan 27 '17 at 20:28
rbinionrbinion
111
asked Jan 27 '17 at 20:28
rbinionrbinion
111
asked Jan 27 '17 at 20:28
rbinionrbinion
111
asked Jan 27 '17 at 20:28
rbinionrbinion
111
asked Jan 27 '17 at 20:28
rbinionrbinion
111
111
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Yes, in theory. WSS uses HTTP for the handshake, once the session is negotiated it is passed to WSS.
However, load balancer come in many forms and protocol implementations can leave a lot to be desired.
NGNIX seems to be a good option as they actually provide mention to this on their website.
Resources:
https://www.nginx.com/blog/websocket-nginx/
http://nginx.org/en/docs/http/websocket.html?_ga=1.232918046.1407092516.1485627218
answered Jan 28 '17 at 18:23
sefkacsefkac
1
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f829077%2fwss-load-balancing-with-ssl-termination-at-layer-4%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Yes, in theory. WSS uses HTTP for the handshake, once the session is negotiated it is passed to WSS.
However, load balancer come in many forms and protocol implementations can leave a lot to be desired.
NGNIX seems to be a good option as they actually provide mention to this on their website.
Resources:
https://www.nginx.com/blog/websocket-nginx/
http://nginx.org/en/docs/http/websocket.html?_ga=1.232918046.1407092516.1485627218
answered Jan 28 '17 at 18:23
sefkacsefkac
1
add a comment |
Yes, in theory. WSS uses HTTP for the handshake, once the session is negotiated it is passed to WSS.
However, load balancer come in many forms and protocol implementations can leave a lot to be desired.
NGNIX seems to be a good option as they actually provide mention to this on their website.
Resources:
https://www.nginx.com/blog/websocket-nginx/
http://nginx.org/en/docs/http/websocket.html?_ga=1.232918046.1407092516.1485627218
answered Jan 28 '17 at 18:23
sefkacsefkac
1
add a comment |
Yes, in theory. WSS uses HTTP for the handshake, once the session is negotiated it is passed to WSS.
However, load balancer come in many forms and protocol implementations can leave a lot to be desired.
NGNIX seems to be a good option as they actually provide mention to this on their website.
Resources:
https://www.nginx.com/blog/websocket-nginx/
http://nginx.org/en/docs/http/websocket.html?_ga=1.232918046.1407092516.1485627218
answered Jan 28 '17 at 18:23
sefkacsefkac
1
Yes, in theory. WSS uses HTTP for the handshake, once the session is negotiated it is passed to WSS.
However, load balancer come in many forms and protocol implementations can leave a lot to be desired.
NGNIX seems to be a good option as they actually provide mention to this on their website.
Resources:
https://www.nginx.com/blog/websocket-nginx/
http://nginx.org/en/docs/http/websocket.html?_ga=1.232918046.1407092516.1485627218
answered Jan 28 '17 at 18:23
sefkacsefkac
1
answered Jan 28 '17 at 18:23
sefkacsefkac
1
answered Jan 28 '17 at 18:23
sefkacsefkac
1
answered Jan 28 '17 at 18:23
sefkacsefkac
1
1
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f829077%2fwss-load-balancing-with-ssl-termination-at-layer-4%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
KQtu3TKgG8OW MYuHYG8NVNoU,vXWIKcNg0TI7e7uX7p68fn gaK7nTWiT 8yftwhz7LJI2pbbbBTKzX
