HAProxy is not affected by the HTTP/2 Rapid Reset Attack (CVE-2023-44487)

Re:HAProxy is not affected by the HTTP/2 Rapid Reset Attack ... by superq on Wednesday October 11, 2023 @12:08AM (#37840773)

Caddy is a bit quick and dirty, rapidly-developing, with neat plugins but hard to configure for more complex scenarios and too light on the docs (IMO).

HA Proxy is robust, comprehensive, mature, and bulletproof. It's basically boring because it works so well.

If you have to choose only one to learn, choose HA Proxy.

[ Parent | on HN ]

Re:HAProxy is not affected by the HTTP/2 Rapid Reset Attack ... by jiripospisil on Wednesday October 11, 2023 @08:29AM (#37843593)

I wanted to try it out just now but hit a roadblock immediately - it cannot automatically obtain and maintain TLS certificates. You have to use an external client (e.g. acme.sh), set up a cron to check/renew them, and poke HAProxy to reload them if necessary. I'm way past doing this in 2023.

https://www.haproxy.com/blog/haproxy-and-let-s-encrypt

https://github.com/haproxy/haproxy/issues/1864

[ Parent | on HN ]

Re:HAProxy is not affected by the HTTP/2 Rapid Reset Attack ... by nickramirez on Wednesday October 11, 2023 @04:46PM (#37850042)

If getting Let's Encrypt to work with HAProxy is your only struggle, you'll soon overcome it and be loving HAProxy. And there are multiple ways to set up Let's Encrypt, if you don't want to use acme.sh. For example, you could use certbot. There are blog posts that cover that pretty well.

[ Parent | on HN ]

Re:HAProxy is not affected by the HTTP/2 Rapid Reset Attack ... by superq on Friday October 13, 2023 @01:21PM (#37873070)

you may wish to use certbot instead:

https://github.com/acmesh-official/acme.sh/issues/4659

[ Parent | on HN ]