Configuring a TERMINATED_HTTPS listener via CLI / Horizon

Objective

Our Public Cloud Load Balancer is based on OpenStack Octavia and is fully integrated into the Public Cloud universe.

After setting up your Load Balancer, you can configure it with a certificate in order to process HTTPS connections.

This tutorial explains how to configure a secure Public Cloud Load Balancer.

Requirements

• A Public Cloud project in your OVHcloud account
• Preparing your environment for using the OpenStack API
• OpenStack Octavia client and OpenStack Barbican set up
• A certificate from a third-party supplier

If you are not yet familiar with creating a Load Balancer, please follow our guide on Getting started with Load Balancer on Public Cloud before you continue with this tutorial.

Instructions

Attaching a Floating IP address to a Load Balancer

You can find the instructions for this part in this documentation in the section bearing the same name.

Preparing the certificate

For this stage, we need a certificate, which has already been generated.

When your certificate is generated by your supplier, you generally receive 2 or 3 files, described as follows:

• Main certificate (.crt or .pem file).
• Private key (.key file) generated during the CSR request.
• Intermediate certificate or complete chain (.crt file), if supplied. Some suppliers already include the intermediate chain in the main certificate, in which case you will only receive 2 files.

sudo cat <certificate.crt> <intermediate_chain.crt> > main_certificate.pem

You need to create a PKCS#12 package with your certificate inside:

sudo openssl pkcs12 -export -inkey <private_key.key> -in <main_certificate.pem> -out domain.tld.p12

You must download this file directly onto your computer in order to be able to send it to Openstack Barbican (‘Secret as a Service’).

openstack secret store --name='cert-domain.tld' -t 'application/octet-stream' -e 'base64' --payload="$(base64 < domain.tld.p12)"

Configuring your Load Balancer

openstack loadbalancer l7policy create --action REDIRECT_TO_URL --redirect-url https://<your-domain-or-ip> --name redirect-to-https http-listener

Configuring the secure Listener on the Load Balancer

Now that you have managed your certificate, you can add a secure Listener and associate a pool and its members with it:

openstack loadbalancer listener create --protocol-port 443 --protocol TERMINATED_HTTPS --name https-listener --default-tls-container=$(openstack secret list | awk '/ cert-domain.tld / {print $2}') my_load_balancer

openstack loadbalancer pool create --name pool-tls --lb-algorithm ROUND_ROBIN --listener https-listener --protocol HTTP

openstack loadbalancer member create --subnet-id my_subnet --address <private_ip_instance> --protocol-port 80 pool-tls

You can now access your Load Balancer securely. However, you will need to renew your certificate. Check the renewal policy with your certificate provider.

Go further

Official documentation of OpenStack Octavia

Cookbook OpenStack Octavia

Getting started with Load Balancer on Public Cloud

If you need training or technical assistance to implement our solutions, contact your sales representative or click on this link to get a quote and ask our Professional Services experts for assisting you on your specific use case of your project.

Join our community of users.