0

I am trying to configure an haproxy health check for a particular backend such that a 403 error is considered a "successful" response. I tried adding "http-check expect status 403" and "option httpchk" to the backend, but when I add "check" to the server line and restart haproxy, I get an error message saying that the backend "has no server available." The logs contain the error "Layer6 invalid response, info: 'SSL handshake failure.'" What am I missing?

I verified that the certificates themselves were not the problem by using "ssl verify none." If I disable the health check or disable SSL, this works fine, but I cannot get them to work in conjunction.

I'm using haproxy version 1.6.

frontend example_https
    mode http
    option httplog

    bind *:443 ssl crt app-ssl.pem no-sslv3 no-tlsv10

    tcp-request inspect-delay 500ms
    tcp-request content accept if { req.ssl_hello_type 1 }

    option http-server-close
    reqadd X-Forwarded-Proto:\ https

    acl is_some-backend url_beg -i /some-backend
    use_backend example_some-backend if is_some-backend


backend example_some-backend
    mode http
    option httplog
    option httpchk
    http-request redirect scheme https if ! { ssl_fc }
    http-request set-path %[path,regsub(^/some-backend/?,/)]
    http-check expect status 403
    server elb some-backend-dev.example.com:443 resolvers dns resolve-prefer ipv4 ssl ca-file ca-certificates.crt check fall 3 rise 2 inter 1000
2
  • Is the backend actually doing SSL? Apr 2, 2019 at 0:57
  • yes, and as I stated in the description, the ssl configuration I have works fine if I omit the "check" option.
    – amparito
    Apr 2, 2019 at 12:37

1 Answer 1

1

I ended up getting this working by using "option tcp-check" and then explicitly specifying "check port 443" in the server line. This way the requests themselves still use SSL but the health check uses a simple TCP check. It was necessary to explicitly set the health check port even though the port is already specified after the domain name because otherwise, check will default to the server settings and attempt to do a layer 6 check even though tcp-check is specified as an option.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .