Haproxy ssl passthrough breaks curl requests

Question

I have Haproxy configured in TCP mode to balance between 2 servers and passthrough https connections to them. The problem is that when my frontend is in tcp mode, curl requests can't be proceed properly.

This is what I get:

* Rebuilt URL to: https://HOSTNAME/
*   Trying IP...
* Connected to HOSTNAME (IP) port 443 (#0)
* found 173 certificates in /etc/ssl/certs/ca-certificates.crt
* found 697 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_256_GCM_SHA384
*    server certificate verification OK
*    server certificate status verification SKIPPED
*    common name: HOSTNAME (matched)
*    server certificate expiration date OK
*    server certificate activation date OK
*    certificate public key: RSA
*    certificate version: #3
*    subject: CN=HOSTNAME
*    start date: Sun, 03 Jul 2016 13:07:00 GMT
*    expire date: Sat, 01 Oct 2016 13:07:00 GMT
*    issuer: C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3
*    compression: NULL
* ALPN, server accepted to use http/1.1
> GET / HTTP/1.1
> Host: HOSTNAME
> User-Agent: curl/7.47.0
> Accept: */*
> 
* Connection #0 to host HOSTNAME left intact
����%

This is my haproxy.cfg:

global
    log 127.0.0.1 local0 notice
    maxconn 2000
    user haproxy
    group haproxy
    stats socket /etc/haproxy/sock.stat level admin
    ssl-default-bind-options no-sslv3
    ssl-default-bind-ciphers kEECDH+AESGCM+AES128:kEECDH+AES128:kRSA+AESGCM+AES128:kRSA+AES128:!RC4:!aNULL:!eNULL:!MD5:!EXPORT:!LOW:!SEED:!CAMELLIA:!IDEA:!PSK:!SRP:!SSLv2
    tune.ssl.default-dh-param 2048
defaults
    log global
    retries 3
    option redispatch
    timeout connect 5000
    timeout client 5000
    timeout server 5000
frontend https
    mode tcp
    option tcplog
    bind :443 ssl crt /etc/letsencrypt/live/HOSTNAME/haproxy.pem ciphers TLSv1.2 alpn h2,http/1.1
    default_backend nodes
    backend nodes
    mode tcp
    option tcplog
    server node-nginx 172.17.0.73:9999 check
    server node-maint 172.17.0.74:9999 backup
frontend http
    bind :80
    mode http
    redirect scheme https code 301 if !{ ssl_fc }

Is there something I can do? I need OpenGraph preview but it fails because of that.

Answer 1

The problem is that the config does not handle HTTP 1.1 requests at all. You have to define a new backend block for HTTP1.1 requests. Since my servers are powered by nginx, I made it in this way:

listen 9999 default_server;
listen 9998 default_server http2;

This is how my backend looks like:

backend nodes-http2
    mode tcp
    option tcplog
    server node-nginx 172.17.0.73:9998 check
    server node-maint 172.17.0.74:9998 backup

To redirect HTTP2 users, I added this to frontend https section:

use_backend nodes-http2 if { ssl_fc_alpn -i h2 }