# HA proxy as reverse proxy - 502 bad gateway error

**URL:** <https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-502-bad-gateway-error/2475>\
**Category:** Help!\
**Created:** [May 9, 2018, 12:51pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-502-bad-gateway-error/2475 "2018-05-09T12:51:37Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vinod](https://avatars.discourse-cdn.com/v4/letter/v/bbce88/32.png) [@Vinod](https://discourse.haproxy.org/u/Vinod)\
**Post date:** [May 9, 2018, 12:51pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-502-bad-gateway-error/2475/1 "2018-05-09T12:51:37Z")

</div>

We are trying to configure ha proxy to act as reverse proxy for a SSL/TLS Pass-Through design and now we are getting below error when trying to access the site.

502 Bad Gateway  
The server returned an invalid or incomplete response.

Looks like a certificate issue but how do I fix this ? when I am running a openssl s\_client command, I am getting the message

verify error:num=19:self signed certificate in certificate chain  
I also tried running the curl command and the output is as attached. can anyone please help ?

![image](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/1X/78f6e5f41da5ba2295e31dac645db9b1ea5f3e00.png)

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 9, 2018, 1:13pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-502-bad-gateway-error/2475/2 "2018-05-09T13:13:54Z")

</div>

Share the configuration please. Did you install a valid certificate on haproxy?

The curl call is wrong:  
`curl -A **curl** -vvv ....`

---

<div class="post-metadata">

**Author:** ![Vinod](https://avatars.discourse-cdn.com/v4/letter/v/bbce88/32.png) [@Vinod](https://discourse.haproxy.org/u/Vinod)\
**Post date:** [May 9, 2018, 1:37pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-502-bad-gateway-error/2475/3 "2018-05-09T13:37:12Z")

</div>

I think I did by following other articles over the web. How do I verify if I have a valid cert on HA proxy and it’s at a proper place ?

---

<div class="post-metadata">

**Author:** ![Vinod](https://avatars.discourse-cdn.com/v4/letter/v/bbce88/32.png) [@Vinod](https://discourse.haproxy.org/u/Vinod)\
**Post date:** [May 9, 2018, 1:39pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-502-bad-gateway-error/2475/4 "2018-05-09T13:39:17Z")

</div>

I ran the curl call as per your post, this is what I get now,

~]# curl -A -vvv https:  
curl: (77) error setting certificate verify locations:  
CAfile: /usr/share/ssl/certs/ca-bundle.crt  
CApath: none

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 9, 2018, 3:56pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-502-bad-gateway-error/2475/5 "2018-05-09T15:56:05Z")

</div>

I need you to share the haproxy configuration.

If you didn’t pay money for the certificate, and you didn’t setup a let’s encrypt verification, you don’t have a valid cert. You are also talking about SSL pass-through, so I don’t know what you would like to do, and I also do not know what you have actually configured.

So, please do share your configuration.

---

<div class="post-metadata">

**Author:** ![Vinod](https://avatars.discourse-cdn.com/v4/letter/v/bbce88/32.png) [@Vinod](https://discourse.haproxy.org/u/Vinod)\
**Post date:** [May 9, 2018, 4:11pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-502-bad-gateway-error/2475/6 "2018-05-09T16:11:34Z")

</div>

We pay for the cert and I have the cert with me. We also created a .pem file from the cert and uploaded to /usr/share/ssl/certs/ and at /usr/local/share/ca-certificates/ . here’s my config file

global  
maxconn 4096  
user HRIS\_HAProxy  
group HRIS\_HAProxy  
daemon

defaults  
mode https  
option forwardfor  
option httplog  
log 127.0.0.1 local0 notice  
maxconn 2000  
timeout connect 5000  
timeout client 50000  
timeout server 50000

frontend http\_fe

```
    mode http
    bind *:443
    default_backend sharepoint

```

backend sharepoint  
balance roundrobin  
option ssl-hello-chk  
#option redispatch  
mode tcp  
cookie SERVERID insert nocache  
server sharepointserver sharepointserverip:443 check

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 9, 2018, 4:49pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-502-bad-gateway-error/2475/7 "2018-05-09T16:49:04Z")

</div>

So, now you need to decide what you would like to do with haproxy.

Would you like to forward port 443 to the sharepoint server, and let the sharepointserver handle SSL/HTTPS? So Haproxy does not intervene and just forwards?

Or do you want to intercept SSL on haproxy and forward HTTP to the sharepointserver?

Your configuration is wrong either way:

- there is no `mode https` as you declared in the defaults section
- you have `mode http` in the frontend but `mode tcp` in the backend. Use `mode tcp` everywhere (or just put it in the default section) to pass-through SSL

---

<div class="post-metadata">

**Author:** ![Vinod](https://avatars.discourse-cdn.com/v4/letter/v/bbce88/32.png) [@Vinod](https://discourse.haproxy.org/u/Vinod)\
**Post date:** [May 9, 2018, 5:08pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-502-bad-gateway-error/2475/8 "2018-05-09T17:08:13Z")

</div>

Ok, so I corrected that. Changed mode to http in default and changed to tcp in frontend and backend. Still the site doesnt work… same 502 bad gateway… anything I am still missing ? Sorry I am just new HA proxy and linux altogether…

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 9, 2018, 5:19pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-502-bad-gateway-error/2475/9 "2018-05-09T17:19:01Z")

</div>

Why mode http in the default section? Use something like this:

```
global
 maxconn 4096
 user HRIS_HAProxy
 group HRIS_HAProxy
 daemon

defaults
 mode tcp
 log 127.0.0.1 local0 notice
 maxconn 2000
 timeout connect 5000
 timeout client 50000
 timeout server 50000

frontend http_fe
 bind *:443
 default_backend sharepoint

backend sharepoint
 balance roundrobin
 option ssl-hello-chk
 server sharepointserver sharepointserverip:443 check
```

---

<div class="post-metadata">

**Author:** ![Vinod](https://avatars.discourse-cdn.com/v4/letter/v/bbce88/32.png) [@Vinod](https://discourse.haproxy.org/u/Vinod)\
**Post date:** [May 9, 2018, 5:56pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-502-bad-gateway-error/2475/10 "2018-05-09T17:56:07Z")

</div>

Ok, made the changes per your post but still same error… any idea what should I do next ?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 9, 2018, 6:03pm UTC](https://discourse.haproxy.org/t/ha-proxy-as-reverse-proxy-502-bad-gateway-error/2475/11 "2018-05-09T18:03:17Z")

</div>

Check haproxy logs, you are syslogging to 127.0.0.1 after all.

I assume to healthcheck may not work. Try removing the `check` keyword to confirm.