Re: Feature Proposal: Add ssltermination parameter for SNI-based LoadBalancing

On 12/12/2020 13:52, Lukas Meisegeier wrote:
> Thanks for the provided ideas :)
> I use HaProxy for my load-balancing and unfortunately I can't define
> that I want to listen on a port for both ssl and non ssl requests.

Could you configure HaProxy to listen on separate ports for SSL and
non-SSL connections, then? And forward both to the same Postgres server.

> That means if I try to return a fixed response 'S' on the SSLRequest it
> fails with an SSL-Handshake failure cause the server expects a ssl message.

That doesn't sound right to me, or perhaps I have misunderstood what you
mean. If you don't send the SSLRequest to the Postgres server, but "eat"
it in the proxy, the Postgres server will not try to do an SSL handshake.

> I have to say the psql ssl handshake procedure is really unique and
> challenging :D

Yeah. IMAP and SMTP can use "STARTTLS" to switch an unencrypted
connection to encrypted, though. That's pretty similar to the
'SSLRequest' message used in the postgres protocol.

- Heikki