I am trying to configure an haproxy health check for a particular backend such that a 403 error is considered a "successful" response. I tried adding "http-check expect status 403" and "option httpchk" to the backend, but when I add "check" to the server line and restart haproxy, I get an error message saying that the backend "has no server available." The logs contain the error "Layer6 invalid response, info: 'SSL handshake failure.'" What am I missing?
I verified that the certificates themselves were not the problem by using "ssl verify none." If I disable the health check or disable SSL, this works fine, but I cannot get them to work in conjunction.
I'm using haproxy version 1.6.
frontend example_https
mode http
option httplog
bind *:443 ssl crt app-ssl.pem no-sslv3 no-tlsv10
tcp-request inspect-delay 500ms
tcp-request content accept if { req.ssl_hello_type 1 }
option http-server-close
reqadd X-Forwarded-Proto:\ https
acl is_some-backend url_beg -i /some-backend
use_backend example_some-backend if is_some-backend
backend example_some-backend
mode http
option httplog
option httpchk
http-request redirect scheme https if ! { ssl_fc }
http-request set-path %[path,regsub(^/some-backend/?,/)]
http-check expect status 403
server elb some-backend-dev.example.com:443 resolvers dns resolve-prefer ipv4 ssl ca-file ca-certificates.crt check fall 3 rise 2 inter 1000