HAProxy health check with backend ssl servers

Question

I am using HAProxy to achieve high availability. I have server1 and server2 where server1 is active and server 2 is dormant. If server1 goes down, server2 will become active. When server1 is coming up, it will start as dormant, and server2 will remain as active server. Server1 will take the active role when server2 goes down, and so on. Both server1 and server2 are configured with ssl. On HAProxy I am using mode as tcp, so have not configured ssl. I have a web service running on both the servers to determine which server is active currently(I ensure at most one server is active at any time). Expectation is HAProxy would redirect each user request to the active server only. I have the following configuration:

frontend server_connect
        bind *:8043
        option tcplog
        mode    tcp
        default_backend backend_servers

backend backend_servers
        mode tcp
        option httpchk GET /appws/10.2/api/hastatus HTTP/1.1
        http-check expect string ACTIVE
        server master server1.mydomain.com:8043  check
        server standby server2.mydomain.com:8043 check

With this configuration it does not seem working; neither HAProxy is redirecting any request, nor I am receiving any health check call on the web service on the server end. Can anyone suggest the right way to achieve this?

Thanks @Michael-sqlbot. It worked. My final configuration is as follows: server master server1.mydomain.com:8043 check check-ssl verify none server standby server2.mydomain.com:8043 check check-ssl verify none — gbhadhar

Michael - sqlbot Michael - sqlbot · Accepted Answer · 2018-06-07T11:52:34

The check-ssl keyword on each server line is required if the backend speaks SSL but the ssl keyword is not being used (which would be the case when HAProxy is not terminating the TLS session).

It appears that a TLS auth mechanism must be also be specified or otherwise disabled with verify none, which is usually acceptable in a secure environment.

HAProxy health check with backend ssl servers

1 Answers