Azure traffic manager shows Online for TCP/443 probe but Degraded for HTTPS /443 probe

0
votes

I have an Azure Traffic Manager set up to monitor some HTTPS services exposed on via public IP addresses.

When I set the health probe to be TCP / 443, the probe works fine and the endpoint shows Online.

When I set the HTTPS probe on port 443 to /images/favicon.ico, with appropriate host: and user-agent: headers which I have confirmed work with curl-k via command line, and even set allowed HTTP return codes to 100-599, the probe still shows Degraded.

I am wondering if this is because we use a highly secure (A+ rating on qualys SSL checker) SSL cipher suite and only permit TLS 1.2+, and there is an SSL handshake failure by the azure traffic manager monitors?

Is there any way to verify this?

The ciphers our website allows are:

  • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) ECDH x25519 (eq. 3072 bits RSA) FS
  • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) ECDH x25519 (eq. 3072 bits RSA) FS

And again, we only permit TLS 1.2.

Edit: Our server serves an SNI certificate. Supposedly these are 'not supported', not just 'not validated'. Is this what's breaking the HTTPS health probes?

https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-faqs#can-i-monitor-https-endpoints

1
azuresslazure-traffic-manager
Is that a self signed cert? Because you mention -k for curl. And self signed won't work under traffic manager. – evilSnobu
well it's a cert for a vanity domain name that we have. Traffic manager's page says it does not do any cert validation: docs.microsoft.com/en-us/azure/traffic-manager/… – David Sanftenberg
see my edit, we are also serving an SNI certificate. Perhaps the SNI cert is breaking the health probes? – David Sanftenberg
I would raise a support ticket. I don't get the SNI not supported part since adding two *.azurewebsites.net HTTPS endpoints works fine and it's SNI. – evilSnobu

1 Answers

0
votes

I would suggest you to take a Packet capture in the VM and follow the TLS conversation and check where it is failing. Also you can check what is the TLS version did TM use to probe your VM.

I think it fails in the TLS and hence you are not receiving a status code from the server.