HAProxy check port 443

Question

Is it possible to get HAProxy to health check an SSL / port 443 end point?

The check port 443 in the config below fails the health check

HAProxy config below

global
    log         127.0.0.1 local2

    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     50000
    user        haproxy
    group       haproxy
    daemon

    # turn on stats unix socket
    stats socket /var/lib/haproxy/stats

defaults
    mode                    tcp
    log                     global
    option                  dontlognull
    retries                 3
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout check           5s
    maxconn                 15000


#---------------------------------------------------------------------
# status page.
#---------------------------------------------------------------------
listen stats 0.0.0.0:8000
    mode http
    stats enable
    stats uri /haproxy
    stats realm HAProxy

#---------------------------------------------------------------------
# Incoming HTTP -> Admin Redirect Proxy rule
#--------------------------------------------------------------------
listen RedirectToHttps
    mode http
    bind :80
    redirect location https://admin.example.com code 301

#---------------------------------------------------------------------
# Incoming HTTPS -> Admin Proxy rule
#---------------------------------------------------------------------
listen ToHttps
    mode tcp
    bind :443
    option ssl-hello-chk
    balance roundrobin
    option httpchk GET /heartbeat.php HTTP/1.1\r\nHost:\ admin.example.com
    server admin-no-check-test     ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 maxconn 5000
    server admin-150-checkport-80  ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 check port 80 maxconn 5000
    server admin-150-checkport-443 ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 check port 443 maxconn 5000

Answer 1

I believe option ssl-hello-chk and option httpchk are 2 different kinds of checks, but HAProxy will only allow you to use one at a time. You should choose ssl-hello-chk to just check that SSL is there, or use the httpchk to check that particular URI, but not both.