Enable HTTPS for Varnish Cache on CentOS

To enable HTTPS for Varnish Cache on CentOS, you must place a TLS-terminating proxy in front of Varnish, because Varnish itself does not natively support SSL/TLS. The standard setup uses HAProxy or Nginx to handle HTTPS connections and forward decrypted HTTP traffic to Varnish on a local port, typically 6081.

Why Varnish Cannot Handle HTTPS Directly

Varnish Cache is a high-performance HTTP accelerator designed to serve cached content at extreme speed. Its core architecture deliberately omits TLS support: the Varnish Cache project has long stated that TLS termination is out of scope for the main Varnish daemon. Instead, the recommended pattern is to use a dedicated TLS terminator—such as HAProxy, Nginx, or a cloud load balancer—that decrypts incoming HTTPS requests and forwards plain HTTP to Varnish. This separation keeps Varnish focused on caching and allows you to choose the TLS implementation that best fits your security and performance needs.

Prerequisites and Assumptions

This guide assumes you already have Varnish Cache installed and running on CentOS (7, 8, or 9) and that your backend web server (e.g., Apache or Nginx) is configured to serve your site over HTTP on a port like 8080. You will also need a valid TLS certificate—either from a public CA like Let’s Encrypt or an internal CA for testing. The steps below use HAProxy as the TLS terminator because it is lightweight, widely available in CentOS repositories, and integrates cleanly with Varnish.

Step-by-Step: HAProxy in Front of Varnish

Here is the complete process to enable HTTPS on CentOS with Varnish behind HAProxy:

1. Install HAProxy: Run sudo yum install haproxy (or dnf on CentOS 8+).
2. Place your certificate and key: Combine them into a single PEM file, e.g., /etc/haproxy/certs/example.com.pem. The file must contain the certificate chain followed by the private key.
3. Configure HAProxy: Edit /etc/haproxy/haproxy.cfg. Add a frontend listening on port 443 with SSL, and a backend pointing to Varnish’s port 6081.
4. Configure Varnish to listen on localhost: In /etc/varnish/varnish.params, set VARNISH_LISTEN_ADDRESS=127.0.0.1 and VARNISH_LISTEN_PORT=6081. This ensures Varnish only accepts connections from HAProxy.
5. Restart services: sudo systemctl restart haproxy varnish.
6. Test: Access your site via https://yourdomain.com and verify the page loads correctly.

Sample HAProxy Configuration

Below is a minimal HAProxy configuration that terminates TLS and forwards to Varnish. Adjust paths and IPs as needed.

frontend https_frontend
    bind *:443 ssl crt /etc/haproxy/certs/example.com.pem
    default_backend varnish_backend

backend varnish_backend
    server varnish1 127.0.0.1:6081 check

This configuration listens on all interfaces on port 443, uses the certificate in the specified PEM file, and sends all traffic to Varnish on localhost port 6081. You can add HTTP-to-HTTPS redirection by adding a second frontend on port 80 that returns a 301 redirect.

Adjusting Varnish for HTTPS

Once HTTPS is terminated at HAProxy, Varnish receives plain HTTP requests. To make your application aware that the original request was HTTPS, you need to forward the X-Forwarded-Proto header. In HAProxy, add the following line to the frontend:

http-request set-header X-Forwarded-Proto https if { ssl_fc }

This sets the header to https when the connection to HAProxy is SSL. Your backend application should be configured to trust this header (e.g., in WordPress, use a plugin or define $_SERVER['HTTPS'] based on it). Otherwise, your site may generate mixed-content warnings or redirect loops.

Common Problems and Troubleshooting

Here are typical issues you might encounter and how to resolve them:

• Redirect loops: Often caused by the application not detecting HTTPS. Ensure the X-Forwarded-Proto header is set and your app respects it.
• Certificate errors: Check that the PEM file contains the full chain (including intermediate certificates) and that permissions are readable by HAProxy.
• Varnish not receiving traffic: Verify Varnish is listening on 127.0.0.1:6081 with ss -tlnp. Also check HAProxy logs at /var/log/haproxy.log.
• Mixed content warnings: Update your site’s URLs to use HTTPS, or set a Content-Security-Policy header to upgrade insecure requests.

Alternative TLS Terminators

While HAProxy is a solid choice, other options exist:

• Nginx: Often already used as a web server; can act as a reverse proxy with SSL termination. Configuration is similar, using proxy_pass http://127.0.0.1:6081;.
• Varnish Plus: The commercial version of Varnish includes native TLS support via the varnishd with a TLS module. This is a paid solution, but it simplifies architecture if you already have a subscription.
• Cloud load balancers: If your site runs in AWS, Azure, or GCP, you can use their managed load balancers to terminate TLS and forward to Varnish on an internal IP.

Frequently Asked Questions

Can Varnish Cache handle HTTPS natively?

No, the open-source Varnish Cache does not support TLS termination natively. You must use a separate proxy like HAProxy or Nginx to decrypt HTTPS traffic before it reaches Varnish.

Why does Varnish not support TLS?

The Varnish developers have intentionally kept TLS out of the core to maintain performance and simplicity. TLS termination is computationally intensive and is better handled by dedicated software or hardware that can be scaled independently.

Do I need to change my backend server configuration?

Yes, your backend (Apache/Nginx) should listen on a non-standard port (e.g., 8080) and accept HTTP only, since Varnish will forward plain HTTP. Also, ensure your application trusts the X-Forwarded-Proto header to generate HTTPS links.

What if I use Varnish Plus?

Varnish Plus includes native TLS support, so you can configure SSL directly on Varnish without an external proxy. However, it is a commercial product requiring a paid license.

Will HTTPS performance be worse than HTTP?

There is a slight overhead due to TLS handshake and encryption, but with modern hardware and session resumption, the impact is minimal. Varnish still serves cached content from memory, so the overall performance remains very fast.

How do I redirect HTTP to HTTPS?

In HAProxy, add a frontend on port 80 that returns a 301 redirect to the HTTPS URL. For example: http-request redirect scheme https unless { ssl_fc }.

Related

• Why Learn to Code in Kate Instead of VS Code?
• Toyota Prius vs Prius Plug-In Hybrid: Key Differences
• Controller Deadzone: Fix Stick Drift?