HaProxy - Does prefer-client-ciphers mean the client can choose a cipher not supported by a server?

Question

Considering a setup like this:

global
    # intermediate configuration
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets

The bind options set prefer-client-ciphers. The client can choose, but is that choice limits to my provided bind ciphers, or not?

The HaProxy documentation doesn't say: https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#5.1-prefer-client-ciphers

Answer 1

This answer is not based on Haproxy specifically but general TLS behavior:

The TLS client and the TLS server each has a list of ciphers that it can support/accept, these lists are ordered by their respective preference.

During the TLS handshake, the client sends its list of supported ciphers, and the server then has to decide what to actually use.
As long as there is an overlap between their respective lists, it will be possible to pick a cipher that everyone supports and it will be possible to establish a connection.

However, even with such an overlap, the order of their respective lists (ie, their respective preference) may differ.

What this almost universally available setting (the name is different in different software, also often seen with the opposite perspective) determines whose preference should win.

For a long time the typical argument among server operators has been something along the lines "server side wins, don't let that silly client pick some weak cipher we have at the very end of our list" (unless it's absolutely necessary).
However, more recently there has been a movement towards "don't include any cipher we consider weak and let the client have their pick; low-end clients (IoT, lower end mobile devices, and similar) may benefit greatly from being able to pick ChaCha20 over AES".

TL;DR No, the chosen cipher will have to be one that is supported by both the client and the server or the connection will not be established, regardless whose preference wins based on that setting.