Hello folks,
I'm successfully running a HAproxy on a FreeBSD 11.1 machine with several web servers behind it. The HAproxy is doing SSL termination.
My goal is to setup a failover for this setup. I started reading about CARP and from what I've read that should definitely be possible and quite a common setup. But I have a big question: How does that work with SSL termination? I was unable to find any references to that. If I understand the process correctly then both HAproxy hosts will share the same IP and CARP will take care of all the management which basically boils down to that the active machine has the public IP that everybody uses to access the website(s). Therefore, if both HAproxy instances have the same SSL certs on their harddrives (ideally via some replication service) everything should work just fine. Is that correct?
I'm successfully running a HAproxy on a FreeBSD 11.1 machine with several web servers behind it. The HAproxy is doing SSL termination.
My goal is to setup a failover for this setup. I started reading about CARP and from what I've read that should definitely be possible and quite a common setup. But I have a big question: How does that work with SSL termination? I was unable to find any references to that. If I understand the process correctly then both HAproxy hosts will share the same IP and CARP will take care of all the management which basically boils down to that the active machine has the public IP that everybody uses to access the website(s). Therefore, if both HAproxy instances have the same SSL certs on their harddrives (ideally via some replication service) everything should work just fine. Is that correct?
