Haproxy SSL handshake failure

Question

I have a problem with one specific client which hits my haproxy load balancer. The error message in the haproxy logs:]

incoming_ssl/1: SSL handshake failure

The client in question seems to be some Apache Java client or ActiveMq server - either way, it's remote server which we have zero control over.

Using ssldump, I see these lines:

11 5  0.4152 (0.1649)  C>S  Alert
    level           fatal
    value           certificate_unknown
11    0.4152 (0.0000)  C>S  TCP FIN

Using curl / browser everything looks fine and I've done some ssl checks which report no such problems.

I've stripped as much out of my haproxy config file as possible to diagnose the issue. I've even tested hitting the backend (NodeJS) server directly which works fine - the client can connect. It's defo haproxy, I just don't know how I can fix it.

My basic haproxy conf file looks like this:

frontend incoming_ssl
  bind *:443 ssl crt /etc/haproxy/cert.key ca-file /etc/haproxy/cert.pem ciphers ECDHE-RSA-AES256-SHA:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM
  acl flume hdr_dom(host) -i dom.ain.com
  use_backend flume if flume

backend flume :80
  server flume 10.40.14.1:8000 weight 1 maxconn 1000 check inter 2000

Have tried using ssl backend too - same issue. Have tried removing the cipher section too.

Am using godaddy certificates which seem ok for curl / browsers if a little annoying to set up.

Is there something else I can do to get this working? Am running the latest development haproxy 1.5 release 26 but have also tried other recent releases.

Answer 1

This client does not recognize the certificate as a valid one.

Godaddy intermediate certificates have to be included in the file loaded by the "crt".

Check that the whole certificate chain is properly included in the server's certificate:

crt /etc/haproxy/cert.key

From haproxy documentation for the "crt" keyword:

Some CAs (such as Godaddy) offer a drop down list of server types that do not include HAProxy when obtaining a certificate. If this happens be sure to choose a webserver that the CA believes requires an intermediate CA (for Godaddy, selection Apache Tomcat will get the correct bundle, but many others, e.g. nginx, result in a wrong bundle that will not work for some clients).

Answer 2

I think you're mistaken about what ca-file does.

Do this:

cd /etc/haproxy
cat cert.pem cert.key > cert.bundle

bind *:443 ssl crt /etc/haproxy/cert.bundle ciphers ECDHE-RSA-AES256-SHA:-RC4-SHA:HIGH:!MD5:!aNULL:!EDH

Answer 3

I also setup haproxy (2016-05) and in the log i got the error

ssl/1: SSL handshake failure

It seems ssh v2 waits for the server before talking, causing haproxy to mistake it for a ssl connection.

The fix was adding the following lines to ~/.ssh/config

Host my.host.com
  HostName my.host.com
  Port 443
  User MeMe
  ProxyCommand openssl s_client -connect my.host.com:443 -quiet