Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're using haproxy's custom error page feature to show a "fail whale" maintenance page while we're doing deployments to our site.

However, since haproxy cannot show SSL'd users the custom error page, how can I redirect users to a non-SSL'd connection, to show the "fail whale" if there are no backends available?

share|improve this question

As I understand it, you can't redirect clients from within haproxy since it can't interact with SSL connections at all (can't decrypt the request or encrypt the response with the redirection). The connection has to go to some server with SSL support in order to do this.

The only thing I can think of is to set up another webserver with the SSL key/cert and the fail whale page (could even be running on some odd port on the haproxy machine itself, use localhost:4433 or something like that), and have haproxy send all the SSL connections to that server during maintenance.

share|improve this answer
Thanks! ended up just using the local haproxy box to handle the serving of the failwhale page. – robbyt Jun 4 '11 at 18:24
up vote 2 down vote accepted

I ended up installing stunnel on the load balancer, and redirecting traffic back onto port 80 thru the tunnel.

HTTPs client => haproxy:443 => (no backends available, use 'backup' server => (stunnel) => (haproxy, with failwhale page)


listen SSL-via-shared-ip
   mode tcp
   option ssl-hello-chk
   #option httpchk OPTIONS * HTTP/1.1\r\nHost:\ www
   option httpchk HEAD /test.txt HTTP/1.0

# list of web servers
server app1 check port 80 maxconn 60  
server app2 check port 80 maxconn 60  
server failwhale backup maxconn 500

    #error pages#
    ##these are in raw http, not just html ##
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http


; Protocol version (all, SSLv2, SSLv3, TLSv1)
sslVersion = all

options = NO_SSLv2

; PID is created inside the chroot jail
pid = /var/run/stunnel4/

; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

; Some debugging stuff useful for troubleshooting
debug = 7
output = /var/log/stunnel4/stunnel.log

; Certificate/key is needed in server mode and optional in client mode
cert = /etc/ssl/certs/stunnel.pem
key = /etc/ssl/certs/stunnel.pem

; Some security enhancements for UNIX systems - comment them out on Win32
;chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4

; Service-level configuration

accept  = 4443
connect =
TIMEOUTclose = 0
share|improve this answer

The only way HAProxy can do this is if it is also terminating the SSL connections. In this setup the HAProxy server(s) would have the SSL certificates and it would communicate with the server pool via further SSL (a new connection) or straight up HTTP.

Another option is to have a SSL-enabled webserver just for fail-whale serving that'll serve up the same fail-whale page no matter what URI it is passed. That way, you can keep that one server as the 'backup' server and any attempts to connect will get whale-goodness.

share|improve this answer
HAProxy doesn't support SSL at all, either on the frontend or backend configs. You have to use something like stunnel to decrypt the traffic and pass it on. – SimonJGreen Jul 30 '12 at 15:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.