0

I'm having trouble with one of our HAProxy-Servers that uses a backend with TLS. When starting HAProxy the backend will report all servers as down:

Server web_remote/apache_rem_1 is DOWN, reason: Layer6 invalid response, info: "SSL handshake failure", check duration: 41ms. 1 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.

The configuration for the backend is as follows:

backend web_remote
    balance         leastconn
    option          httpchk         HEAD /
    option          redispatch
    retries         3

    default-server  inter 5000 rise 2 fall 5 maxconn 10000 maxqueue 50000

    server apache_rem_1  192.0.2.1:12345           check maxconn 1000 maxqueue 5000 ssl ca-file /etc/ssl/web.pem
    server apache_rem_2  2001:DB8:3:4:5:6:8:12345  check maxconn 1000 maxqueue 5000 ssl ca-file /etc/ssl/web.pem

This backend worked just fine until now, a quick wget on the server also worked and openssl s_client reports the certificate of the backend to be valid.

Is there anything else for HAProxy/TLS that could be configured wrong? How could I debug this issue when everything else reports the handshake was successful?

3 Answers 3

3

After trying to find ways to debug with HAProxy I finally gave in and used tcpdump to debug the network traffic.

By importing the TLS key and the PCAP file into my SSL-enabled Wireshark, I found the error very quickly: The Root CA was unknown to HAProxy, so the verify was failing. It turned out, a coworker changed the cert but didn't know this PEM needs the complete trust chain. Adding the correct root CA to the .PEM file fixed this and the server is back to normal operations.

0

Try adding check-ssl to the server lines to force the health check to run over SSL as well.

2
  • That is a default, so adding that did not make any difference.
    – Izzy
    Apr 24, 2015 at 6:54
  • As far as all the documentation tells me, check-ssl isn't a default. If you have something that says otherwise, I'd like to see it! What about changing the option httpchk HEAD / to option httpchk GET /?
    – GregL
    Apr 24, 2015 at 12:00
0

I had the same issue. It turned out that my backend SSL server didn't support TLSv1.3. So to make it work, I had to use force-tlsv12

server server.example.com 10.0.0.1:443 check ssl verify none force-tlsv12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .