I've been searching the net extensively but I'm not able to find a solution to this problem.

I have setup two servers behind KeepAlived and HAProxy. When both servers are up, I can see that both servers are hit (looking at the application logs) and that both work fine. However, when I take down the primary server, the clients are not able to connect to the second server and fail with SSL Handshake failure. Both servers have identical configurations for HAProxy and their SSL certificates are both identical.

My partial HAProxy configuration is:

listen authentication_service
    bind xxx.xxx.xxx.111:2222 ssl crt /etc/ssl/certs/mycert.pem ciphers ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:!RC4+R$
    balance  roundrobin
    option  tcpka
    option  tcplog
    server serv1 xxx.xxx.xxx.xx1:2222  check inter 2000 rise 2 fall 5
    server serv2 xxx.xxx.xxx.xx2:2222  check inter 2000 rise 2 fall 5

To re-iterate, serv1 on its own or together with serv2 works fine. It's only when I take down serv1 that I get the SSL failures.

The HAProxy log for the failure is:

Jan 3 14:21:08 serv-2 haproxy[9075]: [client ip address]:xyz [03/Jan/2015:14:21:08.734] authentication_service/1: SSL handshake failure

Would anyone be able to help me?

Many thanks in advance,

  • So haproxy is running on serv1 and serv2 as well, HA via keepalived? Does the public IP switch to serv2 when you take down serv1? – Felix Frank Jan 7 '15 at 13:13
  • @FelixFrank Hi. Yes, The haproxy is running on both servers, so is keepalived. The public IP does indeed switch to serv2 when I take down serv1. The connection over HTTP also goes through fine. It's just the HTTPS connections that are throwing SSL Handshake exceptions. – kha Jan 7 '15 at 13:29

The SSL stack on your serv2 is busted, apparently.

Things to check:

  • Are the certificate files identical?
  • Are the haproxy configs identical and currently loaded?
  • Are the SSL libraries identical?
  • Yes, Yes and I have no idea how to check this. I'll try to figure out how to check the SSL libraries. Thank you for your help. – kha Jan 8 '15 at 17:47
  • Try ldd $(which haproxy). – Felix Frank Jan 8 '15 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.