Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to get HAProxy to health check an SSL / port 443 end point?

The check port 443 in the config below fails the health check

HAProxy config below

    log local2

    chroot      /var/lib/haproxy
    pidfile     /var/run/
    maxconn     50000
    user        haproxy
    group       haproxy

    # turn on stats unix socket
    stats socket /var/lib/haproxy/stats

    mode                    tcp
    log                     global
    option                  dontlognull
    retries                 3
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout check           5s
    maxconn                 15000

# status page.
listen stats
    mode http
    stats enable
    stats uri /haproxy
    stats realm HAProxy

# Incoming HTTP -> Admin Redirect Proxy rule
listen RedirectToHttps
    mode http
    bind :80
    redirect location code 301

# Incoming HTTPS -> Admin Proxy rule
listen ToHttps
    mode tcp
    bind :443
    option ssl-hello-chk
    balance roundrobin
    option httpchk GET /heartbeat.php HTTP/1.1\r\nHost:\
    server admin-no-check-test maxconn 5000
    server admin-150-checkport-80 check port 80 maxconn 5000
    server admin-150-checkport-443 check port 443 maxconn 5000
share|improve this question
Isn't it ssl_hello_chk, with underscores instead of dashes? – Alexander Janssen Feb 21 '13 at 17:05
The documentation is not very clear, but looking online and at another questions on server fault I link it is 'ssl-hello-chk' – Robert Feb 21 '13 at 18:10

I believe option ssl-hello-chk and option httpchk are 2 different kinds of checks, but HAProxy will only allow you to use one at a time. You should choose ssl-hello-chk to just check that SSL is there, or use the httpchk to check that particular URI, but not both.

share|improve this answer
Please could you show me where in the documentation is says that? As I am able to get ssl-hello-chk to work with option httpchk when doing a check port 80 – Robert Feb 22 '13 at 16:12
I haven't been able to find it mentioned in the docs, but there were a few forum posts where the HAProxy creator mentioned it (for example,,38918). There was a more recent one as well, but I can't find it again now. The port 80 check may work because it ignores the ssl-hello-chk, but I'm not sure. Does it pass the check if you remove one of the two options? – Paul Kroon Feb 22 '13 at 17:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.