# Haproxy certificate chain not fetched when connected to second haproxy

**URL:** <https://discourse.haproxy.org/t/haproxy-certificate-chain-not-fetched-when-connected-to-second-haproxy/8733>\
**Category:** Help!\
**Created:** [June 1, 2023, 3:05pm UTC](https://discourse.haproxy.org/t/haproxy-certificate-chain-not-fetched-when-connected-to-second-haproxy/8733 "2023-06-01T15:05:03Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jinojohn92](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@jinojohn92](https://discourse.haproxy.org/u/jinojohn92)\
**Post date:** [June 1, 2023, 3:05pm UTC](https://discourse.haproxy.org/t/haproxy-certificate-chain-not-fetched-when-connected-to-second-haproxy/8733/1 "2023-06-01T15:05:03Z")

</div>

Hello All,

I have been searching for quite sometime the issue with my setup with SSL error.

We have a haproxy in tcp mode which connects to another haproxy in tcp mode which in the backend connects to ldap server.

1. First Haproxy server is just used to forward the traffic to 2nd haproxy which binds to 636 port this is done due to network limitation on the client end.

Configuration is as below:  
frontend ldaps\_636  
bind \*:636  
mode tcp  
option tcplog  
log global  
use\_backend ldaps\_636

backend ldaps\_636  
balance roundrobin  
mode tcp  
option ldap-check  
server \<second\_haproxy\_server\>:636 ssl check verify none inter 12000 rise 3 fall 3

1. The second haproxy which binds with 636 and connects to ldap backend servers in port 635. config is as below:

listen ldap\_backend  
bind 0.0.0.0:636  
balance roundrobin  
log global  
mode tcp  
option tcplog  
option httpchk  
server \<ldapserver1\_ip\>:635 check port 5434 inter 12000 rise 3 fall 3  
server \<ldapserver2\_ip\>:635 check port 5434 inter 12000 rise 3 fall 3

But when we perform a ldapsearch we get ldap\_sasl\_bind(SIMPLE): Can’t contact LDAP server (-1)

And when we perform a openssl test no certificates are passed, not sure what is wrong here could someone please help.

_[root@host~]# openssl s\_client -showcerts -verify 5 -connect \<first\_haproxy\>:636_  
_verify depth is 5_  
_CONNECTED(00000003)_  
_write:errno=104_  
_—_  
_no peer certificate available_  
_—_  
_No client certificate CA names sent_  
_—_  
_SSL handshake has read 0 bytes and written 289 bytes_  
_—_