Is it possible to get HAProxy to health check an SSL / port 443 end point?

The check port 443 in the config below fails the health check

HAProxy config below

    log local2

    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     50000
    user        haproxy
    group       haproxy

    # turn on stats unix socket
    stats socket /var/lib/haproxy/stats

    mode                    tcp
    log                     global
    option                  dontlognull
    retries                 3
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout check           5s
    maxconn                 15000

# status page.
listen stats
    mode http
    stats enable
    stats uri /haproxy
    stats realm HAProxy

# Incoming HTTP -> Admin Redirect Proxy rule
listen RedirectToHttps
    mode http
    bind :80
    redirect location https://admin.example.com code 301

# Incoming HTTPS -> Admin Proxy rule
listen ToHttps
    mode tcp
    bind :443
    option ssl-hello-chk
    balance roundrobin
    option httpchk GET /heartbeat.php HTTP/1.1\r\nHost:\ admin.example.com
    server admin-no-check-test     ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 maxconn 5000
    server admin-150-checkport-80  ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 check port 80 maxconn 5000
    server admin-150-checkport-443 ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 check port 443 maxconn 5000

I believe option ssl-hello-chk and option httpchk are 2 different kinds of checks, but HAProxy will only allow you to use one at a time. You should choose ssl-hello-chk to just check that SSL is there, or use the httpchk to check that particular URI, but not both.

|improve this answer|||||
  • Please could you show me where in the documentation is says that? As I am able to get ssl-hello-chk to work with option httpchk when doing a check port 80 – Robert Feb 22 '13 at 16:12
  • I haven't been able to find it mentioned in the docs, but there were a few forum posts where the HAProxy creator mentioned it (for example, serverphorums.com/read.php?10,38918). There was a more recent one as well, but I can't find it again now. The port 80 check may work because it ignores the ssl-hello-chk, but I'm not sure. Does it pass the check if you remove one of the two options? – Paul Kroon Feb 22 '13 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.