We are currently using nginx but we need to proxy upstream to haproxy using HTTP 1.1, which nginx's proxy module does not support.

Is there an reliable, event-driven alternative to nginx that supports HTTP 1.1, SSL, and client-side keep-alive?


You can try varnish or maybe pound.


Thanks to Microsoft's non-standard implementation of SSL (have a google for 'Microsoft SSL close-notify') Keep-alive and SSL are not a happy mix when using a MSIE browser. But there are some indications that MS may be getting better in more recent versions.

In the case of mod_ssl, you can configure different behaviours based on the user-agent. This needs to be done at the place where the SSL is terminated - since it needs to decode the SSL to find the user-agent - then decide whether or not to allow the keep-alive. Since stunnel knows nothing about HTTP, you can't allow for this on the proxy.

So you could try just dropping in stunnel (but it won't do any caching) and hope for the best (keep-alives are configured on the webserver).

Without researching it more, it doesn't make a lot of sense to me to have keep-alives enabled using a non-cacheing proxy and to run the servers behind ha-proxy - all the latter will do is basic load-balancing - you're undermining the failover.

While the advice in HTTP/1.1 was to limit the number of connections per server name to 2, most browser developers have cottoned on to the fact that this does nothing to limit the load on servers - the only effect is to slow down the client by forcing serial requests. So there's less reason to use keep-alive than formerly.

So if you want selective control over keep-alive, then I think the only option would be apache + mod_ssl + mod_proxy


Do you really need http/1.1 on the server side or do you want keep-alive ? 1.1 does not bring much, basically only the chunked encoding and "expect: 100-continue". Chunked encoding is nice when the server compresses but that's not often the case. Now if you think you need keep-alive, just consider the network latency between your nginx and haproxy. If both are on the same LAN, you really don't need keep-alive at all, as the cost of establishing a connection is extremely small. Many people chain nginx and haproxy together without any issue, so I think that you could really keep your nginx.

Alternatively, you could use stunnel in front of haproxy to handle SSL only. You'd then get client-side keep-alive and HTTP/1.1 directly from haproxy.

  • We are thinking of using stunnel. Why is chunked encoding only good when the server compresses? – user41356 Feb 18 '11 at 6:15
  • @Willy Our goal is to use chunked encoding. – user41356 Feb 18 '11 at 6:22
  • -1 for "1.1 does not bring much" (I'd mark it down more if I could!) – symcbean Feb 18 '11 at 13:51
  • @user41356: I've not said chunked encoding is only good when the server compresses, but that in this situation it's particularly useful. It has other uses but they are less common. – Willy Tarreau Feb 22 '11 at 5:38
  • 1
    @Willy - presumably you are using nginx for performance reasons - HTTP/1.1 adds the 'Cache-Control', 'Varies', lots of changes to conditional requests, improved compression. Then there's also the functional stuff - better handling of content encoding, a formal definition of how to handle redirects....its all in the spec. – symcbean Feb 22 '11 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.