Haproxy SSL to backend

Help!
1

Hi

I have enabled SSL between Haproxy 1.5.18 and my JBoss Nodes. My config for this looks

backend jboss
balance roundrobin
mode http
server node1.com 10.0.0.1:8443 check ssl verify required ca-file /etc/pki/ca-trust/source/anchors/ca_chain.crt verifyhost www.app.com
server node2.com 10.0.0.2:8443 check ssl verify required ca-file /etc/pki/ca-trust/source/anchors/ca_chain.crt verifyhost www.app.com

note I have verifyhost www.app.com because both nodes use the same cert with the CN www.app.com. This helps with using one cert for many nodes.

The problem I am having is , in the jboss logs I see alot (every sec) of debug Warnings

Connection reset by peer

any idea whats the issue here

2

Can you confirm it actually works? You are only looking to fix the debug warnings, right?

This is most likely caused by the TCP level haproxy health checks. Try enabling HTTP health checks (but make sure they actually succeed) with option httpchk.

3

Yes the SSL connection does work

4

So what you saying is change my config to the below?

backend jboss
balance roundrobin
mode http
option httpchk
server node1.com 10.0.0.1:8443  ssl verify required ca-file /etc/pki/ca-trust/source/anchors/ca_chain.crt verifyhost www.app.com
server node2.com 10.0.0.2:8443  ssl verify required ca-file /etc/pki/ca-trust/source/anchors/ca_chain.crt verifyhost www.app.com
5

Just add option httpchk. You need to leave the check keyword for each server, otherwise you disabled health checking.

6

yeah that’s what I thought but when I leave the check key word it still gives the SSL message.

removing the check key word does disable the health checking.

7

So with option httpchk in the configuration and check keyword on the server line, you still see this message?

And when the check keyword is removed and therfor, heatlh checking does not work, can you confirm the error message is gone?

8

So with option httpchk in the configuration and check keyword on the server line, you still see this message?
Yes

And when the check keyword is removed and therfor, heatlh checking does not work, can you confirm the error message is gone?
Yes Error Message gone