Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am getting 400 bad request error under apache ssl logs on real hosts when using haproxy option ssl-hello-chk. My setup uses haproxy as a load balancer to handle ssl requests and pass it on to the reals. AFAIK "ssl-hello-chk" in haproxy sends ssl hello mesg to the hosts to make sure hosts are available. this is better than the normal tcp only check. Any idea why its logging 400 error when hello messages should not be logged at all. Also not sure if it is working correctly?

Thanks, Tevez G

share|improve this question

1 Answer 1

You can increase the apache loglevel to get more information about the HAPROXY hello request.

To see what happens you could use curl and switch on verbose messages:

curl -k -v https://real-https-apache.com

Curl should inform you about the different processess including client-hello and server-hello.

Then also check apache logs

This is how such a curl request looks like:

$ curl -k -v https://graph.facebook.com
* About to connect() to graph.facebook.com port 443 (#0)
*   Trying 66.220.146.100... connected
* Connected to graph.facebook.com (66.220.146.100) port 443 (#0)
* error setting certificate verify locations, continuing anyway:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* SSLv2, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using AES128-SHA
* Server certificate:
*        subject: /C=US/ST=California/L=Palo Alto/O=Facebook, Inc./CN=*.facebook.com
*        start date: 2010-01-13 00:00:00 GMT
*        expire date: 2013-04-11 23:59:59 GMT
*        common name: *.facebook.com (matched)
*        issuer: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3
* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
> GET / HTTP/1.1
> User-Agent: curl/7.18.0 (i486-pc-linux-gnu) libcurl/7.18.0 OpenSSL/0.9.8g zlib/1.2.3.3 libidn/1.1
> Host: graph.facebook.com
> Accept: */*
> 
< HTTP/1.1 302 Found
< Cache-Control: private, no-cache, no-store, must-revalidate
< Expires: Sat, 01 Jan 2000 00:00:00 GMT
< Location: http://developers.facebook.com/docs/api
< Pragma: no-cache
< X-FB-Rev: 575092
< Content-Type: text/html; charset=utf-8
< X-FB-Debug: sYq1u5Ffp1JE7p5IafErxiU6MNT6i1fXCEkn51nFxr8=
< Date: Mon, 18 Jun 2012 10:49:17 GMT
< Connection: keep-alive
< Content-Length: 0
< 
* Connection #0 to host graph.facebook.com left intact
* Closing connection #0
* SSLv3, TLS alert, Client hello (1):
share|improve this answer
    
I did some debugging as mentioned above. Here is the output of openssl and apache debug logs for reference. Not sure what the error is with the handshake. –  Tevez G Jun 19 '12 at 8:47
    
I did some debugging as mentioned above. Here is the output of openssl and apache debug logs for reference. Not sure what the error is with the handshake.openssl s_client -state -nbio -connect domainname.com:443 2>&1 | grep ^SSL SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:error in SSLv2/v3 read server hello A SSL_connect:SSLv3 read server hello A SSL_connect:error in SSLv3 read server certificate A SSL_connect:error in SSLv3 read server certificate A –  Tevez G Jun 19 '12 at 9:07
    
Apache debug logs: –  Tevez G Jun 19 '12 at 9:11
    
Apache debug logs: `Mon Jun 18 07:27:24 2012] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 read client hello A [Mon Jun 18 07:27:24 2012] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 write server hello A [Mon Jun 18 07:27:24 2012] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 write certificate A –  Tevez G Jun 19 '12 at 9:15
    
[Mon Jun 18 07:27:24 2012] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 write server done A [Mon Jun 18 07:27:24 2012] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: SSLv3 flush data [Mon Jun 18 07:27:24 2012] [debug] ssl_engine_io.c(1775): OpenSSL: read 1/5 bytes from BIO#55556f7c9380 [mem: 55556f824a70] (BIO dump follows) [Mon Jun 18 07:27:24 2012] [debug] ssl_engine_io.c(1722): +-------------------------------------------------------------------------+ [Mon Jun 18 07:27:24 2012] [debug] ssl_engine_io.c(1751): | 0001 - <SPACES/NULS> –  Tevez G Jun 19 '12 at 9:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.