0

I have Haproxy configured in TCP mode to balance between 2 servers and passthrough https connections to them. The problem is that when my frontend is in tcp mode, curl requests can't be proceed properly.

This is what I get:

* Rebuilt URL to: https://HOSTNAME/
*   Trying IP...
* Connected to HOSTNAME (IP) port 443 (#0)
* found 173 certificates in /etc/ssl/certs/ca-certificates.crt
* found 697 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_256_GCM_SHA384
*    server certificate verification OK
*    server certificate status verification SKIPPED
*    common name: HOSTNAME (matched)
*    server certificate expiration date OK
*    server certificate activation date OK
*    certificate public key: RSA
*    certificate version: #3
*    subject: CN=HOSTNAME
*    start date: Sun, 03 Jul 2016 13:07:00 GMT
*    expire date: Sat, 01 Oct 2016 13:07:00 GMT
*    issuer: C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3
*    compression: NULL
* ALPN, server accepted to use http/1.1
> GET / HTTP/1.1
> Host: HOSTNAME
> User-Agent: curl/7.47.0
> Accept: */*
> 
* Connection #0 to host HOSTNAME left intact
����%

This is my haproxy.cfg:

global
    log 127.0.0.1 local0 notice
    maxconn 2000
    user haproxy
    group haproxy
    stats socket /etc/haproxy/sock.stat level admin
    ssl-default-bind-options no-sslv3
    ssl-default-bind-ciphers kEECDH+AESGCM+AES128:kEECDH+AES128:kRSA+AESGCM+AES128:kRSA+AES128:!RC4:!aNULL:!eNULL:!MD5:!EXPORT:!LOW:!SEED:!CAMELLIA:!IDEA:!PSK:!SRP:!SSLv2
    tune.ssl.default-dh-param 2048
defaults
    log global
    retries 3
    option redispatch
    timeout connect 5000
    timeout client 5000
    timeout server 5000
frontend https
    mode tcp
    option tcplog
    bind :443 ssl crt /etc/letsencrypt/live/HOSTNAME/haproxy.pem ciphers TLSv1.2 alpn h2,http/1.1
    default_backend nodes
    backend nodes
    mode tcp
    option tcplog
    server node-nginx 172.17.0.73:9999 check
    server node-maint 172.17.0.74:9999 backup
frontend http
    bind :80
    mode http
    redirect scheme https code 301 if !{ ssl_fc }

Is there something I can do? I need OpenGraph preview but it fails because of that.

2
  • Hmm, seems like it's an HTTP2 problem there.
    – Defman
    Jul 20, 2016 at 22:57
  • Okay, the problem was that I didn't support HTTP 1.1 requests at all. I've added a new backend especially for HTTP2.0 and made my servers listening another port for HTTP2.0 (:9998).
    – Defman
    Jul 20, 2016 at 23:11

1 Answer 1

0

The problem is that the config does not handle HTTP 1.1 requests at all. You have to define a new backend block for HTTP1.1 requests. Since my servers are powered by nginx, I made it in this way:

listen 9999 default_server;
listen 9998 default_server http2;

This is how my backend looks like:

backend nodes-http2
    mode tcp
    option tcplog
    server node-nginx 172.17.0.73:9998 check
    server node-maint 172.17.0.74:9998 backup

To redirect HTTP2 users, I added this to frontend https section:

use_backend nodes-http2 if { ssl_fc_alpn -i h2 }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.