实验原理
haproxy和客户端使用功能https协议，后端使用http协议
实验架构

1.在centos7上编译安装haproxy2.4.17

编译安装haproxy2.4.17

2.利用系统Makefile文件生成自签名证书（centos7才有）

1.切换目录查看Makefile文件
[root@haproxy:~]#
cd /etc/pki/tls/certs
[root@haproxy:/etc/pki/tls/certs]#
ls
ca-bundle.crt        localhost.crt    Makefile
ca-bundle.trust.crt  make-dummy-cert  renew-dummy-cert
#centos7默认有Makefile文件，可以直接生成自签名证书

2.提前新建证书存放目录
[root@haproxy:/etc/pki/tls/certs]#
mkdir /etc/haproxy/conf.d/ssl

3.修改证书中的加密部分，防止每次使用添加密码。
[root@haproxy:/etc/pki/tls/certs]#
vim Makefile  #注释原来的项，添加的项不加密，方便使用。
%.key:
        umask 77 ; \
        #/usr/bin/openssl genrsa -aes128 $(KEYLEN) > $@
        /usr/bin/openssl genrsa  $(KEYLEN) > $@

4.生成证书
[root@haproxy:/etc/pki/tls/certs]#
make /etc/haproxy/conf.d/ssl/www.magedu.org.crt
umask 77 ; \
#/usr/bin/openssl genrsa -aes128 2048 > /etc/haproxy/conf.d/ssl/www.magedu.org.key
/usr/bin/openssl genrsa  2048 > /etc/haproxy/conf.d/ssl/www.magedu.org.key
Generating RSA private key, 2048 bit long modulus
...............+++
.................................................................+++
e is 65537 (0x10001)
umask 77 ; \
/usr/bin/openssl req -utf8 -new -key /etc/haproxy/conf.d/ssl/www.magedu.org.key -x509 -days 365 -out /etc/haproxy/conf.d/ssl/www.magedu.org.crt 
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:magedu
Common Name (eg, your name or your server's hostname) []:www.magedu.org
Email Address []:
[root@haproxy:/etc/pki/tls/certs]#
ls /etc/haproxy/conf.d/ssl
www.magedu.org.crt  www.magedu.org.key
[root@haproxy:/etc/pki/tls/certs]#
cd /etc/haproxy/conf.d/ssl

5.证书合二为一
[root@haproxy:/etc/haproxy/conf.d/ssl]#  #证书合二为一
cat www.magedu.org.key  www.magedu.org.crt > www.magedu.org.pem

3.修改haproxy的配置文件

1.创建子配置文件，在自配置文件中配置规则更方便
[root@haproxy:~]#
mkdir /etc/haproxy/conf.d/

2..添加子配置目录到unit文件中
[root@haproxy:~]#
vim /lib/systemd/system/haproxy.service
[Unit]
Description=HAProxy Load Balancer
After=syslog.target network.target

[Service]
#修改下面两行
ExecStartPre=/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -f
/etc/haproxy/conf.d/ -c -q
ExecStart=/usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -f
/etc/haproxy/conf.d/ -p /var/lib/haproxy/haproxy.pid
ExecReload=/bin/kill -USR2 $MAINPID

[Install]
WantedBy=multi-user.target

[root@centos7 ~]#systemctl daemon-reload
[root@centos7 ~]#systemctl restart haproxy


3.修改haproxy配置文件，实现https
[root@haproxy:/etc/haproxy/conf.d/ssl]#
vim /etc/haproxy/conf.d/test.cfg 

listen web_http_https_nodes
    bind 10.0.0.100:80
    bind 10.0.0.100:443 ssl crt /etc/haproxy/conf.d/ssl/www.magedu.org.pem
    redirect scheme https if !{ ssl_fc } #访问http时，实现重定向到https
    balance roundrobin
    server web1 10.0.0.18:80 check inter 3000 fall 3 rise 5
    server web2 10.0.0.28:80 check inter 3000 fall 3 rise 5
[root@haproxy:/etc/haproxy/conf.d/ssl]#
systemctl restart haproxy

4.2.后端服务器安装httpd并准备访问页面

1.安装并启动httpd
1)
[root@rs1:~]#
yum -y install httpd;systemctl enable --now htppd

2)
[root@rs1:~]#
yum -y install httpd;systemctl enable --now htppd

2.生成页面文件
1）
[root@rs1:~]#
hosname -I > /var/www/html/index.html

2）
[root@rs2:~]#
hosname -I > /var/www/html/index.html

5.客户端测试

1.能正常访问https网站
[root@client:~]#
curl -k https://10.0.0.100
10.0.0.18 
[root@client:~]#
curl -k https://10.0.0.100
10.0.0.28 

2.实现访问http时，重定向到http是
[root@client:~]#
curl  http://10.0.0.100 -I
HTTP/1.1 302 Found
content-length: 0
location: https://10.0.0.100/
cache-control: no-cache
[root@client:~]#
curl  http://10.0.0.100 -Lk
10.0.0.18 
[root@client:~]#
curl  http://10.0.0.100 -Lk
10.0.0.28