|
2 | 2 | <html lang="en"> |
3 | 3 | <head> |
4 | 4 | <meta charset="utf-8" /> |
5 | | - <title>HAProxy version 3.3-dev10-56 - Configuration Manual</title> |
| 5 | + <title>HAProxy version 3.3-dev10-69 - Configuration Manual</title> |
6 | 6 | <link href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet" /> |
7 | 7 | <link href="https://raw.githubusercontent.com/thomaspark/bootswatch/v3.3.7/cerulean/bootstrap.min.css" rel="stylesheet" /> |
8 | 8 | <link href="../css/page.css?0.4.2-15" rel="stylesheet" /> |
|
3745 | 3745 |
|
3746 | 3746 | <a class="list-group-item" href="#ssl-mode-async">ssl-mode-async</a> |
3747 | 3747 |
|
| 3748 | + <a class="list-group-item" href="#ssl-passphrase-cmd">ssl-passphrase-cmd</a> |
| 3749 | + |
3748 | 3750 | <a class="list-group-item" href="#ssl-propquery">ssl-propquery</a> |
3749 | 3751 |
|
3750 | 3752 | <a class="list-group-item" href="#ssl-provider">ssl-provider</a> |
|
3891 | 3893 |
|
3892 | 3894 | <a class="list-group-item" href="#ssl_fc_early_exporter_secret">ssl_fc_early_exporter_secret</a> |
3893 | 3895 |
|
| 3896 | + <a class="list-group-item" href="#ssl_fc_early_rcvd">ssl_fc_early_rcvd</a> |
| 3897 | + |
3894 | 3898 | <a class="list-group-item" href="#ssl_fc_ecformats_bin">ssl_fc_ecformats_bin</a> |
3895 | 3899 |
|
3896 | 3900 | <a class="list-group-item" href="#ssl_fc_eclist_bin">ssl_fc_eclist_bin</a> |
|
4683 | 4687 | You can use <strong>left</strong> and <strong>right</strong> arrow keys to navigate between chapters.<br> |
4684 | 4688 | </p> |
4685 | 4689 | <p class="text-right"> |
4686 | | - <small>Converted with <a href="https://github.com/cbonte/haproxy-dconv">haproxy-dconv</a> v<b>0.4.2-15</b> on <b>2025/10/23</b></small> |
| 4690 | + <small>Converted with <a href="https://github.com/cbonte/haproxy-dconv">haproxy-dconv</a> v<b>0.4.2-15</b> on <b>2025/10/29</b></small> |
4687 | 4691 | </p> |
4688 | 4692 | </div> |
4689 | 4693 | <!-- /.sidebar --> |
|
4694 | 4698 | <div class="text-center"> |
4695 | 4699 | <h1><a href="http://www.haproxy.org/" title="HAProxy"><img src="../img/HAProxyCommunityEdition_60px.png?0.4.2-15" /></a></h1> |
4696 | 4700 | <h2>Configuration Manual</h2> |
4697 | | - <p><strong>version 3.3-dev10-56</strong></p> |
| 4701 | + <p><strong>version 3.3-dev10-69</strong></p> |
4698 | 4702 | <p> |
4699 | 4703 | 2025/10/18<br> |
4700 | 4704 |
|
@@ -8962,6 +8966,16 @@ <h2 id="chapter-3.1" data-target="3.1"><small><a class="small" href="#3.1">3.1.< |
8962 | 8966 | Custom DH parameters may be generated by using the OpenSSL command |
8963 | 8967 | "openssl dhparam <size>", where size should be at least 2048, as 1024-bit DH |
8964 | 8968 | parameters should not be considered secure anymore. |
| 8969 | +</pre><a class="anchor" name="ssl-passphrase-cmd"></a><a class="anchor" name="3-ssl-passphrase-cmd"></a><a class="anchor" name="3.1-ssl-passphrase-cmd"></a><a class="anchor" name="ssl-passphrase-cmd (Global section)"></a><a class="anchor" name="ssl-passphrase-cmd (Process management and security)"></a><div class="keyword"><b><a class="anchor" name="ssl-passphrase-cmd"></a><a href="#3.1-ssl-passphrase-cmd">ssl-passphrase-cmd</a></b> <span style="color: #080"><cmd></span> <span style="color: #080"><args></span> ...</div><pre class="text">This settings is only available when support for OpenSSL was built in. It |
| 8970 | +allows to define a full command line that will be called when an encrypted |
| 8971 | +certificate is loaded during init. The command could be a script or any other |
| 8972 | +program. It will be provided with the encrypted private key path as first |
| 8973 | +parameter and the user-defined "args" parameters then and should dump the |
| 8974 | +passphrase that allows to decode the encrypted private key on the standard |
| 8975 | +output. |
| 8976 | +For every new encrypted private key loaded during init, HAProxy will first |
| 8977 | +try every other already known passphrase to decode the private key and will |
| 8978 | +ultimately call the passphrase command again if none works. |
8965 | 8979 | </pre><a class="anchor" name="ssl-propquery"></a><a class="anchor" name="3-ssl-propquery"></a><a class="anchor" name="3.1-ssl-propquery"></a><a class="anchor" name="ssl-propquery (Global section)"></a><a class="anchor" name="ssl-propquery (Process management and security)"></a><div class="keyword"><b><a class="anchor" name="ssl-propquery"></a><a href="#3.1-ssl-propquery">ssl-propquery</a></b> <span style="color: #080"><query></span></div><pre class="text">This setting is only available when support for OpenSSL was built in and when |
8966 | 8980 | OpenSSL's version is at least 3.0. It allows to define a default property |
8967 | 8981 | string used when fetching algorithms in providers. It behave the same way as |
@@ -23801,7 +23815,7 @@ <h2 id="chapter-7.1" data-target="7.1"><small><a class="small" href="#7.1">7.1.< |
23801 | 23815 | that were not initially planned, or with sample fetch methods which return a |
23802 | 23816 | string. The matching method also affects the way the patterns are parsed. So, |
23803 | 23817 | it must not be used with sample fetches with a matching suffix (_beg, _end, |
23804 | | -_sub...). In addition, specifying several "-m" pattern matching methods is now |
| 23818 | +_sub...). In addition, specifying several "-m" pattern matching methods is not |
23805 | 23819 | allowed. |
23806 | 23820 |
|
23807 | 23821 | The "-n" flag forbids the dns resolutions. It is used with the load of ip files. |
@@ -28233,6 +28247,13 @@ <h3 id="chapter-7.3.4" data-target="7.3.4"><small><a class="small" href="#7.3.4" |
28233 | 28247 | </pre><a class="anchor" name="ssl_fc_curve"></a><a class="anchor" name="7-ssl_fc_curve"></a><a class="anchor" name="7.3.4-ssl_fc_curve"></a><a class="anchor" name="ssl_fc_curve (Using ACLs and fetching samples)"></a><a class="anchor" name="ssl_fc_curve (Fetching samples at Layer 5)"></a><div class="keyword"><b><a class="anchor" name="ssl_fc_curve"></a><a href="#7.3.4-ssl_fc_curve">ssl_fc_curve</a></b> : string</div><pre class="text">Returns the name of the curve used in the key agreement when the incoming |
28234 | 28248 | connection was made over an SSL/TLS transport layer. This requires |
28235 | 28249 | OpenSSL >= 3.0.0. |
| 28250 | +</pre><a class="anchor" name="ssl_fc_early_rcvd"></a><a class="anchor" name="7-ssl_fc_early_rcvd"></a><a class="anchor" name="7.3.4-ssl_fc_early_rcvd"></a><a class="anchor" name="ssl_fc_early_rcvd (Using ACLs and fetching samples)"></a><a class="anchor" name="ssl_fc_early_rcvd (Fetching samples at Layer 5)"></a><div class="keyword"><b><a class="anchor" name="ssl_fc_early_rcvd"></a><a href="#7.3.4-ssl_fc_early_rcvd">ssl_fc_early_rcvd</a></b> : boolean</div><pre class="text">Returns true if early data were seen over that connection, regardless of the |
| 28251 | +fact that the handshake has since completed. It has no practical use case for |
| 28252 | +traffic processing, however it's about the only way to "see" that a client |
| 28253 | +used 0-RTT to send early data, and is sometimes useful when debugging, since |
| 28254 | +the only other alternatives are network traffic captures or logging the front |
| 28255 | +connection's flags and matching them in the code. It may also be useful to |
| 28256 | +get statistics on clients' capabilities. See also "<a href="#ssl_fc_has_early">ssl_fc_has_early</a>". |
28236 | 28257 | </pre><a class="anchor" name="ssl_fc_early_exporter_secret"></a><a class="anchor" name="7-ssl_fc_early_exporter_secret"></a><a class="anchor" name="7.3.4-ssl_fc_early_exporter_secret"></a><a class="anchor" name="ssl_fc_early_exporter_secret (Using ACLs and fetching samples)"></a><a class="anchor" name="ssl_fc_early_exporter_secret (Fetching samples at Layer 5)"></a><div class="keyword"><b><a class="anchor" name="ssl_fc_early_exporter_secret"></a><a href="#7.3.4-ssl_fc_early_exporter_secret">ssl_fc_early_exporter_secret</a></b> : string</div><pre class="text">Return the EARLY_EXPORTER_SECRET as an hexadecimal string for the |
28237 | 28258 | front connection when the incoming connection was made over an TLS 1.3 |
28238 | 28259 | transport layer. |
@@ -28325,9 +28346,10 @@ <h3 id="chapter-7.3.4" data-target="7.3.4"><small><a class="small" href="#7.3.4" |
28325 | 28346 | certificate is not present in the current connection but may be retrieved |
28326 | 28347 | from the cache or the ticket. So prefer "<a href="#ssl_c_used">ssl_c_used</a>" if you want to check if |
28327 | 28348 | current SSL session uses a client certificate. |
28328 | | -</pre><a class="anchor" name="ssl_fc_has_early"></a><a class="anchor" name="7-ssl_fc_has_early"></a><a class="anchor" name="7.3.4-ssl_fc_has_early"></a><a class="anchor" name="ssl_fc_has_early (Using ACLs and fetching samples)"></a><a class="anchor" name="ssl_fc_has_early (Fetching samples at Layer 5)"></a><div class="keyword"><b><a class="anchor" name="ssl_fc_has_early"></a><a href="#7.3.4-ssl_fc_has_early">ssl_fc_has_early</a></b> : boolean</div><pre class="text">Returns true if early data were sent, and the handshake didn't happen yet. As |
28329 | | -it has security implications, it is useful to be able to refuse those, or |
28330 | | -wait until the handshake happened. |
| 28349 | +</pre><a class="anchor" name="ssl_fc_has_early"></a><a class="anchor" name="7-ssl_fc_has_early"></a><a class="anchor" name="7.3.4-ssl_fc_has_early"></a><a class="anchor" name="ssl_fc_has_early (Using ACLs and fetching samples)"></a><a class="anchor" name="ssl_fc_has_early (Fetching samples at Layer 5)"></a><div class="keyword"><b><a class="anchor" name="ssl_fc_has_early"></a><a href="#7.3.4-ssl_fc_has_early">ssl_fc_has_early</a></b> : boolean</div><pre class="text">Returns true if early data were sent, and the handshake didn't complete yet. |
| 28350 | +As it has security implications, it is useful to be able to refuse those, or |
| 28351 | +wait until the handshake completes (via the "<a href="#wait-for-handshake">wait-for-handshake</a>" action). See |
| 28352 | +also "<a href="#ssl_fc_early_rcvd">ssl_fc_early_rcvd</a>". |
28331 | 28353 | </pre><a class="anchor" name="ssl_fc_has_sni"></a><a class="anchor" name="7-ssl_fc_has_sni"></a><a class="anchor" name="7.3.4-ssl_fc_has_sni"></a><a class="anchor" name="ssl_fc_has_sni (Using ACLs and fetching samples)"></a><a class="anchor" name="ssl_fc_has_sni (Fetching samples at Layer 5)"></a><div class="keyword"><b><a class="anchor" name="ssl_fc_has_sni"></a><a href="#7.3.4-ssl_fc_has_sni">ssl_fc_has_sni</a></b> : boolean</div><pre class="text">This checks for the presence of a Server Name Indication TLS extension (SNI) |
28332 | 28354 | in an incoming connection was made over an SSL/TLS transport layer. Returns |
28333 | 28355 | true when the incoming connection presents a TLS SNI field. This requires |
@@ -33641,7 +33663,7 @@ <h2 id="chapter-12.8" data-target="12.8"><small><a class="small" href="#12.8">12 |
33641 | 33663 | <br> |
33642 | 33664 | <hr> |
33643 | 33665 | <div class="text-right"> |
33644 | | - HAProxy 3.3-dev10-56 – Configuration Manual<br> |
| 33666 | + HAProxy 3.3-dev10-69 – Configuration Manual<br> |
33645 | 33667 | <small>, 2025/10/18</small> |
33646 | 33668 | </div> |
33647 | 33669 | </div> |
|
0 commit comments