Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to get HAProxy to health check an SSL / port 443 end point?

The check port 443 in the config below fails the health check

HAProxy config below

global
    log         127.0.0.1 local2

    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     50000
    user        haproxy
    group       haproxy
    daemon

    # turn on stats unix socket
    stats socket /var/lib/haproxy/stats

defaults
    mode                    tcp
    log                     global
    option                  dontlognull
    retries                 3
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout check           5s
    maxconn                 15000


#---------------------------------------------------------------------
# status page.
#---------------------------------------------------------------------
listen stats 0.0.0.0:8000
    mode http
    stats enable
    stats uri /haproxy
    stats realm HAProxy

#---------------------------------------------------------------------
# Incoming HTTP -> Admin Redirect Proxy rule
#--------------------------------------------------------------------
listen RedirectToHttps
    mode http
    bind :80
    redirect location https://admin.example.com code 301

#---------------------------------------------------------------------
# Incoming HTTPS -> Admin Proxy rule
#---------------------------------------------------------------------
listen ToHttps
    mode tcp
    bind :443
    option ssl-hello-chk
    balance roundrobin
    option httpchk GET /heartbeat.php HTTP/1.1\r\nHost:\ admin.example.com
    server admin-no-check-test     ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 maxconn 5000
    server admin-150-checkport-80  ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 check port 80 maxconn 5000
    server admin-150-checkport-443 ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 check port 443 maxconn 5000
share|improve this question
    
Isn't it ssl_hello_chk, with underscores instead of dashes? –  Alexander Janssen Feb 21 '13 at 17:05
    
The documentation is not very clear, but looking online and at another questions on server fault I link it is 'ssl-hello-chk' –  Robert Feb 21 '13 at 18:10

1 Answer 1

I believe option ssl-hello-chk and option httpchk are 2 different kinds of checks, but HAProxy will only allow you to use one at a time. You should choose ssl-hello-chk to just check that SSL is there, or use the httpchk to check that particular URI, but not both.

share|improve this answer
    
Please could you show me where in the documentation is says that? As I am able to get ssl-hello-chk to work with option httpchk when doing a check port 80 –  Robert Feb 22 '13 at 16:12
    
I haven't been able to find it mentioned in the docs, but there were a few forum posts where the HAProxy creator mentioned it (for example, serverphorums.com/read.php?10,38918). There was a more recent one as well, but I can't find it again now. The port 80 check may work because it ignores the ssl-hello-chk, but I'm not sure. Does it pass the check if you remove one of the two options? –  Paul Kroon Feb 22 '13 at 17:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.