<div dir="auto">For multiple certificates, simply put multiple pem-file lines in hitch.conf, and you're good to go :-)<br><br><div data-smartmail="gmail_signature">-- <br>Guillaume Quintard </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Aug 16, 2017 12:30, "Admin Beckspaced" <<a href="mailto:admin@beckspaced.com">admin@beckspaced.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Thanks Guillaume,<br>
<br>
will then have a look into the info you provided and report back if I run into any trouble trying to setup hitch ;)<br>
<br>
What's your recommendation of up-to-date documents on how to setup hitch in front of varnish with multiple vhost SSL certificates?<br>
<br>
So far I found:<br>
<br>
<a href="https://github.com/varnish/hitch" rel="noreferrer" target="_blank">https://github.com/varnish/hit<wbr>ch</a><br>
<a href="https://hitch-tls.org/" rel="noreferrer" target="_blank">https://hitch-tls.org/</a><br>
<br>
Is there any docu elsewhere you can recommend?<br>
<br>
Thanks a lot for your support!<br>
<br>
Greetings<br>
Becki<br>
<br>
<br>
On 16.08.2017 09:57, Guillaume Quintard wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
At the risk of insisting, hitch is super easy to setup, once installed, you just need to:<br>
- Edit /etc/hitch/hitch.conf to<br>
- Set the front-end, usually *:443<br>
- Set the backend (where to send decrypted traffic), <a href="http://127.0.0.1:8443" rel="noreferrer" target="_blank">127.0.0.1:8443</a> <<a href="http://127.0.0.1:8443" rel="noreferrer" target="_blank">http://127.0.0.1:8443</a>><br>
- Set the pem-file line to point to a certificate<br>
- Add "-a <a href="http://127.0.0.1:8443" rel="noreferrer" target="_blank">127.0.0.1:8443</a> <<a href="http://127.0.0.1:8443" rel="noreferrer" target="_blank">http://127.0.0.1:8443</a>>,PROXY" to Varnish command.<br>
<br>
The Varnish part will be needed anyway if you want to use the proxy protocol.<br>
<br>
The docs here <a href="https://docs.varnish-software.com/varnish-cache-plus/features/client-ssl/" rel="noreferrer" target="_blank">https://docs.varnish-software.<wbr>com/varnish-cache-plus/feature<wbr>s/client-ssl/</a> can help you (except that the name of the package differs) but the crux of it is really what I listed above.<br>
<br>
So we can do better next time, what didn't you like about the info you got about hitch?<br>
<br>
-- <br>
Guillaume Quintard<br>
<br>
On Aug 16, 2017 09:29, "Admin Beckspaced" <<a href="mailto:admin@beckspaced.com" target="_blank">admin@beckspaced.com</a> <mailto:<a href="mailto:admin@beckspaced.com" target="_blank">admin@beckspaced.com</a>>> wrote:<br>
<br>
Thanks a lot for your suggestion for using HaProxy ;)<br>
<br>
My thinking was just: why install another bit of software when<br>
apache is able to do the SSL termination.<br>
But like Andrei said, if traffic spikes hit the apache runaround<br>
will not be the optimal solution.<br>
<br>
Do you guys have any recent up-to-date tutorials / howtos on<br>
setting up HaProxy as SSL terminator in front of varnish.<br>
also doing the SSL redirects ...<br>
<br>
Did look around for Hitch but wasn't very pleased with the info<br>
provided ;(<br>
<br>
Any hints are welcome & thanks for your help & replies ;)<br>
<br>
Greetings<br>
Becki<br>
<br>
<br>
<br>
On 15.08.2017 22:04, Jan Hugo Prins | BetterBe wrote:<br>
<br>
I would not do it like that.<br>
Better is to use something like Hitch or HaProxy (my<br>
preference) and put that in front of Varnish.<br>
Then HaProxy / Hitch can terminate all SSL traffic, and<br>
HaProxy can also do your redirect to SSL if needed.<br>
Then in Varnish you use the Apache server as a backend and let<br>
it only serve what it needs to serve.<br>
Use the ProxyProtocol to send the client information from<br>
HaProxy to Vernish.<br>
In Varnish you need to put the client IP into the<br>
X-Forwarded-For header.<br>
In Apache you can then use this header to have the real client<br>
IP address.<br>
<br>
This way you have the real client IP information on all layers.<br>
<br>
Jan Hugo Prins<br>
<br>
<br>
<br>
<br>
______________________________<wbr>_________________<br>
varnish-misc mailing list<br>
<a href="mailto:varnish-misc@varnish-cache.org" target="_blank">varnish-misc@varnish-cache.org</a> <mailto:<a href="mailto:varnish-misc@varnish-cache.org" target="_blank">varnish-misc@varnish-c<wbr>ache.org</a>><br>
<a href="https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc" rel="noreferrer" target="_blank">https://www.varnish-cache.org/<wbr>lists/mailman/listinfo/varnish<wbr>-misc</a><br>
<<a href="https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc" rel="noreferrer" target="_blank">https://www.varnish-cache.org<wbr>/lists/mailman/listinfo/varnis<wbr>h-misc</a>><br>
<br>
</blockquote>
<br>
</blockquote></div></div>