# Haproxy 2.0.5 httpchk http/2 backend

**URL:** <https://discourse.haproxy.org/t/haproxy-2-0-5-httpchk-http-2-backend/4281>\
**Category:** Help!\
**Created:** [September 11, 2019, 9:43am UTC](https://discourse.haproxy.org/t/haproxy-2-0-5-httpchk-http-2-backend/4281 "2019-09-11T09:43:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![czechsys](https://avatars.discourse-cdn.com/v4/letter/c/898d66/32.png) [@czechsys](https://discourse.haproxy.org/u/czechsys)\
**Post date:** [September 11, 2019, 9:43am UTC](https://discourse.haproxy.org/t/haproxy-2-0-5-httpchk-http-2-backend/4281/1 "2019-09-11T09:43:01Z")

</div>

Hello,

i am testing using http/2 on backend side. So on ssl backend:

option httpchk HEAD / HTTP/1.1\r\nHost:\ serverA.domain.fqdn\r\n\User-Agent:\ serverA  
server serverA ipA:443 check ssl verify none maxconn 1000 alpn h2,http/1.1

This works, if nginx has only http/1.1 enabled.  
When i change to

option httpchk HEAD / HTTP/2.0\r\nHost:\ serverA.domain.fqdn\r\n\User-Agent:\ serverA

it still works.

But, when i enable “alpn http2” on nginx side, haproxy fails to checks with L7RSP. What’s correct way to check via http/2 or better way (i am checking working php/source codes availability too). Tested with all headers lowercase and failed too.

Thanks

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [September 11, 2019, 10:23am UTC](https://discourse.haproxy.org/t/haproxy-2-0-5-httpchk-http-2-backend/4281/2 "2019-09-11T10:23:08Z")

</div>

`httpchk` does not support H2, therefor if you enable H2 on nginx and haproxy, H2 will be negotiated and used, which leads to failure.

Limit check alpn to http1:

```
server serverA ipA:443 check ssl verify none maxconn 1000 alpn h2,http/1.1 check-alpn http/1.1
```

---

<div class="post-metadata">

**Author:** ![czechsys](https://avatars.discourse-cdn.com/v4/letter/c/898d66/32.png) [@czechsys](https://discourse.haproxy.org/u/czechsys)\
**Post date:** [September 11, 2019, 12:07pm UTC](https://discourse.haproxy.org/t/haproxy-2-0-5-httpchk-http-2-backend/4281/3 "2019-09-11T12:07:42Z")

</div>

Thanks, it worked.

---

<div class="post-metadata">

**Author:** ![lucid\_thayne](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/lucid_thayne/32/660_2.png) [@lucid\_thayne](https://discourse.haproxy.org/u/lucid_thayne)\
**Post date:** [June 12, 2020, 11:10pm UTC](https://discourse.haproxy.org/t/haproxy-2-0-5-httpchk-http-2-backend/4281/4 "2020-06-12T23:10:49Z")

</div>

> `httpchk` does not support H2

are there any plans to add h2 support to httpchk?

I have a grpc server which _only_ supports http/2. I’d like to do an L7 health check, but the backend server doesn’t support http/1.1. at all.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [June 13, 2020, 9:58pm UTC](https://discourse.haproxy.org/t/haproxy-2-0-5-httpchk-http-2-backend/4281/5 "2020-06-13T21:58:40Z")

</div>

Will be in 2.2:

> <https://github.com/haproxy/haproxy/issues/683>
>
> Output of haproxy -vv and uname -a
> HA-Proxy version 2.0.14 2020/04/02 - https://haproxy.org/
> Build options :
> TARGET = linux-glibc
> CPU = generic
> CC...

---

<div class="post-metadata">

**Author:** ![jerome](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/jerome/32/984_2.png) [@jerome](https://discourse.haproxy.org/u/jerome)\
**Post date:** [June 17, 2020, 9:02am UTC](https://discourse.haproxy.org/t/haproxy-2-0-5-httpchk-http-2-backend/4281/6 "2020-06-17T09:02:57Z")

</div>

While a bit hackish it’s possible to perform h2 checks before haproxy 2.2. It won’t scale well with a lot of servers though. The idea is to check through an htx enabled listener, and h1 checks are translated to h2 by the listener before they hit your server.

```
defaults
  mode http

frontend foo
  bind *:1443 ssl crt ssl.pem
  default_backend bfoo

backend bfoo
  option httpchk GET / HTTP/1.1\r\nHost:\ foo.bar
  server s1 a.b.c:443 ssl verify none alpn h2 addr 127.0.0.1 port 8443 no-check-ssl check

listen s1
  bind 127.0.0.1:8443 
  server s1 a.b.c:443 ssl verify none alpn h2
```