[exim] Exim + Multi domain SSL + HA Proxy

[Matt Bryant]

All,

For legacy reasons need to support smtps on port 465 and whilst exim
supports SNI, and indeed have that working atm, am now trying to put it
behind the HAProxy LB ... which is where things are going pear shape..
is this even possible ??? or would I need to terminate SSL on haproxy
then just proxy on to backend ???

TLS error on connection from [x.x.x.x] (SSL_accept): error:140760FC:SSL
routines:SSL23_GET_CLIENT_HELLO:unknown protocol

I dont need to route SSL just want everything to go to same server and
haproxy to forward on the SNI information so that exim can pick up on it
.. or am i totally off base here ????

rgds

Matt Bryant

[Jeremy Harris]

Post by Matt Bryant
am now trying to put it
behind the HAProxy LB ... which is where things are going pear shape..

Why on earth do something that fragile, when MX use gives perfectly
good HA for a store-and-forward protocol?
--
Cheers,
Jeremy

[Patrick von der Hagen]

Post by Jeremy Harris

Post by Matt Bryant
am now trying to put it
behind the HAProxy LB ... which is where things are going pear shape..

Why on earth do something that fragile, when MX use gives perfectly
good HA for a store-and-forward protocol?

Port 465 ist obviously "legacy submission" and submission is a very
valid reason to run some HAProxy-Setup. More likely for avability than
speed, but still. Running a different product here, so can't comment on
HAProxy.
--
Karlsruher Institut fÃŒr Technologie (KIT)
Steinbuch Centre for Computing (SCC)

Patrick von der Hagen

Zirkel 2, GebÀude 20.21, Raum 004.2
76131 Karlsruhe
Telefon: [phone]
E-Mail: ***@kit.edu
Web: http://www.scc.kit.edu

KIT - UniversitÀt des Landes Baden-WÌrttemberg und
nationales Forschungszentrum in der Helmholtz-Gemeinschaft

[Matt Bryant]

Dont have an issue with inbound and MX servers ... this is for a shared
outbound client SMTP relay cluster where SMTP Auth is used and clients
connect via a branded DNS name (potentially).

rgds

Matt Bryant

2 November 2015 at 7:41 PM
Why on earth do something that fragile, when MX use gives perfectly
good HA for a store-and-forward protocol?
2 November 2015 at 11:09 AM
All,
For legacy reasons need to support smtps on port 465 and whilst exim
supports SNI, and indeed have that working atm, am now trying to put
it behind the HAProxy LB ... which is where things are going pear
shape.. is this even possible ??? or would I need to terminate SSL on
haproxy then just proxy on to backend ???
error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol
I dont need to route SSL just want everything to go to same server and
haproxy to forward on the SNI information so that exim can pick up on
it .. or am i totally off base here ????
rgds
Matt Bryant

[Jeremy Harris]

Post by Matt Bryant
Dont have an issue with inbound and MX servers ... this is for a shared
outbound client SMTP relay cluster where SMTP Auth is used and clients
connect via a branded DNS name (potentially).

"branded" ?

But even so, the clients will be doing a DNS A-lookup? Will they
handle multiple IPs returned? Hmm, damn, clients are dumber than
MTAs aren't they.

Post by Matt Bryant
SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol

Are you certain that's not just an SSL protocol/cipher configuration
incompat issue? Can you get packet captures at both ends and
see if the packets get through the LB ?

[Jeremy Harris]

HAProxy is a layer 4 load-balancing protocol that can be configured
to load balance connections *before* SSL termination.[...]
the HA proxy protocol

You're saying it's not transparent? Aargh.

Matt: you may well need to compile an Exim version including
EXPERIMENTAL_PROXY. See doc-txt/experimental-spec.txt .