I have created a load balancer in GCP for using HTTPS to forward it to the HTTPS backend group. I have configured the Instance to use HTTPS by creating a certificate on the instance and when I curl from the instance itself I get the following
curl https://localhost
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
root@instance:/var/log/apache2# curl https://localhost -k
<WebPage content>
I checked the GCP documentation on Encryption from the load balancer to the backends and have configured the backend and health check as stated.
However, the health check shows UNHEALTHY, and the health check log shows
healthCheckProbeResult: {
connectLatency: "0.000651s"
detailedHealthState: "TIMEOUT"
healthCheckProtocol: "HTTPS"
healthState: "UNHEALTHY"
ipAddress: "10.8.1.4"
previousDetailedHealthState: "UNKNOWN"
previousHealthState: "UNHEALTHY"
probeCompletionTimestamp: "2021-08-11T07:46:06.973978919Z"
probeRequest: "/user"
probeResultText: "HTTP response: , Error: Protocol error"
probeSourceIp: "35.191.1.154"
responseLatency: "0.002054s"
targetIp: "<internal IP>"
targetPort: 443
}
When I only use HTTP, by changing apache and backend configurations, the site works fine.
I cannot debug what the actual issue is here.
I want there to be encryption between the load balancer and the backend. So any other methods will be welcomed.
The health check error is TIMEOUT. This means your backend did accept a connection on port 443.
Your question does not detail how Apache/Nginx? is configured.
Check that you have configured a port 443 listener in your web server.
Check if you have enabled a VPC firewall rule for port 443.
The default VPC firewall rule default-all-https allows traffic on port 443. You can optionally apply the Network tag named https-server to the VM instance.
Provided that the backend web service is running and listening on port 443, the following command will enable the default firewall rule for HTTPS port 443.
Apply the https-server network tag to a Compute Engine VM instance:
gcloud compute instances add-tags [INSTANCE_NAME] \
--zone [INSTANCE_ZONE] \
--tags="https-server"
List your Compute Engine VM instances and review the tags:
gcloud compute instances list --format="table(name,status,tags.list())"
Note: The above steps are good for debugging. However, that will allow the entire Internet to connect to your backend. A better solution is to create a firewal rule only allowing traffic from the load balancer and the health check service. The addresses to allow are:
The following command will create a VPC firewall rule allowing all instances to receive traffic from Google Cloud Load Balancers and Health Check services. This rule can be fine-tuned to assign to specific instances:
gcloud compute firewall-rules create "lb-rule" --allow=tcp:80,tcp:443 \
--source-ranges="10.0.0.0/22,10.0.0.0/14" \
--source-ranges="130.211.0.0/22,35.191.0.0/16" \
--description="Allow traffic from load balancer and health check services"