0

Hey I seem to have issues with HAProxy but can't seem to find the root of the problem.

Setup:

1 Load Balancer

3 Servers (Splunk Search Heads)

Both Load Balancer and the 3 servers are only accessible through https and all have different SSL certs. I'm trying to have encrypted traffic from the Client to the Load Balancer and then encrypted traffic from the Load Balancer to the Server. These sessions in the future will also need to be sticky. As an FYI I've changed the IPs in the config below to private IPs for this.

I can ping the servers from the load balancer and access them correctly from a browser (not going through load balancer). The SSL cert on the Load Balancer is working but instead of redirecting to one of the servers I get a 503 error: "503 Service Unavailable - No servers are available to handle this request."

Below is my config file. Any help would be appreciated as this is my first time using HAProxy.

global
   ssl-server-verify none

frontend https443
   mode http
   bind *:443 ssl cert /ect/haproxy/cert/haproxy.pem
   timeout client 60s
   reqadd X-Forwarded-Proto:\ https
   default_backend allservers

backend allservers
   mode http
   balance roundrobin
   timeout connect 10s
   timeout server 100s
   server server1 192.168.23.1:8000 check ssl
   server server2 192.168.23.2:8000 check ssl
   server server3 192.168.23.3:8000 check ssl
Improve this question
1
  • your as the topic :) welcome
    – c4f4t0r
    Jul 30, 2020 at 7:11

1 Answer 1

Reset to default
3

Check that the respective SSL certs on the backends cover 192.168.23.x. If not, then HAProxy considers their cert to be invalid.

Solution should be either (a) update HAProxy config so that the backend servers are referred to by a DN/IP covered by the existing SSL on each backend node; or (b) update the SSL on the backend nodes to cover the private IP; or (c) disable SSL certificate validation.

Improve this answer
4
  • In global I have"ssl-server-verify none" which tells HAProxy to ignore certificate validation. So I'm not sure that's the issue
    – HAProxy Help
    Jul 30, 2020 at 16:13
  • Change check ssl to check ssl check-ssl. If that doesn't work, add option log-health-checks and look at HAProxy log output.
    – tater
    Jul 30, 2020 at 16:25
  • That gave me the logs I needed to fix it! SELinux was blocking HAProxy from connecting to the servers. Thanks so much! I've been slamming my head against this for 8 hours
    – HAProxy Help
    Jul 30, 2020 at 17:24
  • I didn't really have SELinux in mind as the problem here, but pleased that it put you on the track to the real issue!
    – tater
    Jul 31, 2020 at 0:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .