# How to setup HTTP check for TCP backend in HAProxy?

**URL:** <https://discourse.haproxy.org/t/how-to-setup-http-check-for-tcp-backend-in-haproxy/2508>\
**Category:** Help!\
**Created:** [May 19, 2018, 4:40am UTC](https://discourse.haproxy.org/t/how-to-setup-http-check-for-tcp-backend-in-haproxy/2508 "2018-05-19T04:40:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kaizenCoder](https://avatars.discourse-cdn.com/v4/letter/k/ec9cab/32.png) [@kaizenCoder](https://discourse.haproxy.org/u/kaizenCoder)\
**Post date:** [May 19, 2018, 4:40am UTC](https://discourse.haproxy.org/t/how-to-setup-http-check-for-tcp-backend-in-haproxy/2508/1 "2018-05-19T04:40:30Z")

</div>

The documentation suggests that I can setup a HTTP check for a TCP backend.

The liveness of my backend is determined by a `405 Method Not allowed` response when hitting `a-app.com/ap_service`

My config looks like this:

```auto
    frontend app-api
        bind *:443
        mode tcp
    
        option tcplog
        default_backend app-api_backend
    
    
    backend app-api_backend
        mode tcp
        option httpchk GET /app_service HTTP/1.1
        http-check expect status 405
        server a a-app.com:443 resolvers dns verify none inter 1000 check
        server b b-app.com:443 resolvers dns verify none inter 1000 check

```

However, in the logs I get:

```auto
    Server app-api_backend/a is DOWN, reason: Layer7 invalid response, check duration: 1ms. 1 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
    Server app-api_backend/b is DOWN, reason: Layer7 invalid response, check duration: 1ms. 1 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.

```

**SOLVED** :

@lukastribus pointed me in the right direction. Working config looks like the following:

```auto
 backend app-api_backend
        mode tcp
        option httpchk OPTIONS /app_service HTTP/1.1
        server a a-app.com:443 resolvers dns verify none inter 1000 check check-ssl
        server b b-app.com:443 resolvers dns verify none inter 1000 check check-ssl

```

`check-ssl` was the missing piece. I also discovered the API endpoint supports the `OPTIONS` method which returns a `200 OK`. so substituted that instead.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 19, 2018, 9:03am UTC](https://discourse.haproxy.org/t/how-to-setup-http-check-for-tcp-backend-in-haproxy/2508/2 "2018-05-19T09:03:03Z")

</div>

It’s doesn’t fail because TCP mode doesn’t support this, it fails because you did not tell haproxy that the health check has to be encrypted. It sends plaintext HTTP to your port 443 as health check.

Specify the [check-ssl](https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#check-ssl) directive on each server to make haproxy use a SSL layer, therefor making a HTTPS request for the health check.