# Basic haproxy setup continues to throw ERR\_SSL\_PROTOCOL\_ERROR

**URL:** <https://discourse.haproxy.org/t/basic-haproxy-setup-continues-to-throw-err-ssl-protocol-error/11593>\
**Category:** Help!\
**Created:** [January 31, 2025, 11:12pm UTC](https://discourse.haproxy.org/t/basic-haproxy-setup-continues-to-throw-err-ssl-protocol-error/11593 "2025-01-31T23:12:50Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gorf](https://avatars.discourse-cdn.com/v4/letter/g/848f3c/32.png) [@Gorf](https://discourse.haproxy.org/u/Gorf)\
**Post date:** [January 31, 2025, 11:12pm UTC](https://discourse.haproxy.org/t/basic-haproxy-setup-continues-to-throw-err-ssl-protocol-error/11593/1 "2025-01-31T23:12:50Z")

</div>

Ive put together a very simple configuration. I have haproxy 3.1 deployed with the following configuration:

```auto
global
        log /dev/log local0
        log /dev/log local1 debug
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin
        stats timeout 30s
        user haproxy
        group haproxy
        daemon
        stats socket /var/run/haproxy.sock mode 600 level admin

        # Default SSL material locations
        ca-base /etc/ssl/certs
        crt-base /etc/ssl/private

        # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

defaults
        log global
        mode http
        option httplog
        option dontlognull
        timeout connect 5000
        timeout client 50000
        timeout server 50000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http

frontend test
    bind *:80    
    bind *:443 ssl crt /etc/ssl/private/mydomain.pem
    default_backend web_servers

backend web_servers
    balance roundrobin
    server server1 10.0.131.75:80

```

Super simple. And I can hit the HTTP site with zero problems. However, the TLS side is a different story. I banged out a self signed cert and pretty much just expected this to work. But on firefox I’m getting the ERR\_SSL\_PROTOCOL\_ERROR error back. And even with debug level logging turned on, this is all I get in my logs:

```auto
2025-01-31T22:23:02.995649+00:00 ip-10-0-132-14 haproxy[22600]: [NOTICE] (22600) : Initializing new worker (22604)
2025-01-31T22:23:03.053383+00:00 ip-10-0-132-14 haproxy[22600]: [NOTICE] (22600) : Loading success.
2025-01-31T22:23:54.506079+00:00 ip-10-0-132-14 haproxy[22604]: 10.0.0.75:18632 [31/Jan/2025:22:23:54.504] test test/<NOSRV> -1/-1/-1/-1/0 400 0 - - PR-- 2/2/0/0/0 0/0 "<BADREQ>"
2025-01-31T22:23:54.506230+00:00 ip-10-0-132-14 haproxy[22604]: 10.0.0.75:18632 [31/Jan/2025:22:23:54.504] test test/<NOSRV> -1/-1/-1/-1/0 400 0 - - PR-- 2/2/0/0/0 0/0 "<BADREQ>"
2025-01-31T22:23:54.506872+00:00 ip-10-0-132-14 haproxy[22604]: 10.0.0.75:46138 [31/Jan/2025:22:23:54.505] test test/<NOSRV> -1/-1/-1/-1/0 400 0 - - PR-- 1/1/0/0/0 0/0 "<BADREQ>"
2025-01-31T22:23:54.506970+00:00 ip-10-0-132-14 haproxy[22604]: 10.0.0.75:46138 [31/Jan/2025:22:23:54.505] test test/<NOSRV> -1/-1/-1/-1/0 400 0 - - PR-- 1/1/0/0/0 0/0 "<BADREQ>"
2025-01-31T22:23:54.554930+00:00 ip-10-0-132-14 haproxy[22604]: 10.0.0.75:43714 [31/Jan/2025:22:23:54.554] test test/<NOSRV> -1/-1/-1/-1/0 400 0 - - PR-- 1/1/0/0/0 0/0 "<BADREQ>"
2025-01-31T22:23:54.555236+00:00 ip-10-0-132-14 haproxy[22604]: 10.0.0.75:43714 [31/Jan/2025:22:23:54.554] test test/<NOSRV> -1/-1/-1/-1/0 400 0 - - PR-- 1/1/0/0/0 0/0 "<BADREQ>"
2025-01-31T22:23:54.556145+00:00 ip-10-0-132-14 haproxy[22604]: 10.0.0.75:46492 [31/Jan/2025:22:23:54.556] test test/<NOSRV> -1/-1/-1/-1/0 400 0 - - PR-- 1/1/0/0/0 0/0 "<BADREQ>"
2025-01-31T22:23:54.556200+00:00 ip-10-0-132-14 haproxy[22604]: 10.0.0.75:46492 [31/Jan/2025:22:23:54.556] test test/<NOSRV> -1/-1/-1/-1/0 400 0 - - PR-- 1/1/0/0/0 0/0 "<BADREQ>"

```

I’m stuck. Did I miss something obvious because I literally can’t figure out what the problem is. The request never makes it back to the webserver. It’s being blocked at the haproxy level. But even with debug logging, it doesn’t show anything useful. Nor does the admin socket:

```auto
root@ip-10-0-132-14:/usr/bin# echo "show errors" | socat /var/run/haproxy.sock stdio
Total events captured on [31/Jan/2025:23:07:17.948] : 54

[31/Jan/2025:23:05:44.834] frontend test (#2): invalid request
  backend <NONE> (#-1), server <NONE> (#-1), event #53, src 10.0.0.75:61325
  buffer starts at 0 (including 0 out), 15847 free,
  len 537, wraps at 16336, error at position 0
  H1 connection flags 0x00000000, H1 stream flags 0x00000810
  H1 msg state MSG_RQBEFORE(0), H1 msg flags 0x00001400
  H1 chunk len 0 bytes, H1 body len 0 bytes :

```