# L6RSP health-check error on the SSL-backend

**URL:** <https://discourse.haproxy.org/t/l6rsp-health-check-error-on-the-ssl-backend/1405>\
**Category:** Help!\
**Created:** [July 4, 2017, 5:07pm UTC](https://discourse.haproxy.org/t/l6rsp-health-check-error-on-the-ssl-backend/1405 "2017-07-04T17:07:01Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![nick.t](https://avatars.discourse-cdn.com/v4/letter/n/9f8e36/32.png) [@nick.t](https://discourse.haproxy.org/u/nick.t)\
**Post date:** [July 4, 2017, 5:07pm UTC](https://discourse.haproxy.org/t/l6rsp-health-check-error-on-the-ssl-backend/1405/1 "2017-07-04T17:07:01Z")

</div>

Hello all.  
I’m using HA-Proxy version 1.7.6 and trying to setup some sites with SSL on the IIS web-server behind the HAProxy. My config is below

```
frontend https-frontend
  bind 192.168.30.133:443 ssl strict-sni crt /etc/haproxy/ssl/
  mode http
  ... (set/modify some headers in request and response)
  use_backend app1 if { hdr_end(host) -i app1.example.com }

backend app1
  mode http
  balance roundrobin

  option httpchk HEAD / HTTP/1.1\r\nHost:app1.example.com
  http-check expect rstatus (2|3)[0-9][0-9]
  default-server inter 5s fall 2 rise 2

  option httpclose
  http-reuse safe
  option forwardfor except 127.0.0.0/8
  http-request set-header X-Client-IP %[src]
  http-request set-header X-Forwarded-Port %[dst_port]
  http-request add-header X-Forwarded-Proto https if { ssl_fc }

  cookie SERVERID insert indirect nocache
  server srv1 1.2.3.4:443 ca-file /etc/haproxy/ssl/app1.example.com.issuer ssl verify required verifyhost app1.example.com check check-ssl

```

I’ve tried many combinations with the same result. With health-check is enabled clients get 503 error (as expected since helath-check failed and no more backend servers are available). But even if I remove “ssl” and “httpchk” directives (then health-check seems to be passed “L4OK”), but backend doesn’t work - the browser shows errors something like “Secure connection failed” or “Empty response”.  
Direct connection from the client’s workstation to the backend-server is working normally.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 4, 2017, 5:42pm UTC](https://discourse.haproxy.org/t/l6rsp-health-check-error-on-the-ssl-backend/1405/2 "2017-07-04T17:42:13Z")

</div>

I assume the certificate verification of your backend fails. Check the CA configuration (especially app1.example.com.issuer) and try with “verify none” to confirm that it is indeed the root cause.

---

<div class="post-metadata">

**Author:** ![nick.t](https://avatars.discourse-cdn.com/v4/letter/n/9f8e36/32.png) [@nick.t](https://discourse.haproxy.org/u/nick.t)\
**Post date:** [July 4, 2017, 8:13pm UTC](https://discourse.haproxy.org/t/l6rsp-health-check-error-on-the-ssl-backend/1405/3 "2017-07-04T20:13:14Z")

</div>

Thank you! Already tried - the same error. Also this config but without SSL on the backend works fine. Do you know investigation methods in this case? Anything special I should watch for?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 4, 2017, 8:40pm UTC](https://discourse.haproxy.org/t/l6rsp-health-check-error-on-the-ssl-backend/1405/4 "2017-07-04T20:40:25Z")

</div>

Likely there is a problem with the SSL handshake.

Maybe your backend server requires haproxy to send a SNI value?

Add “sni ssl\_fc\_sni” to your server line, or “sni str([app1.example.com](http://app1.example.com))”.

---

<div class="post-metadata">

**Author:** ![nick.t](https://avatars.discourse-cdn.com/v4/letter/n/9f8e36/32.png) [@nick.t](https://discourse.haproxy.org/u/nick.t)\
**Post date:** [July 5, 2017, 12:00pm UTC](https://discourse.haproxy.org/t/l6rsp-health-check-error-on-the-ssl-backend/1405/5 "2017-07-05T12:00:16Z")

</div>

> Likely there is a problem with the SSL handshake.

Yes, the full string is “Layer6 invalid response: Connection error during SSL handshake (Connection reset by peer)”

> Maybe your backend server requires haproxy to send a SNI value?

Sure. I wrote “…some sites on the one web-server…”. I’m sorry for my English if I’m not being clear.

With “sni str(…)” I got “SOCKERR - Socket error: Connection reset by peer”

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 5, 2017, 1:13pm UTC](https://discourse.haproxy.org/t/l6rsp-health-check-error-on-the-ssl-backend/1405/6 "2017-07-05T13:13:08Z")

</div>

Either you are still not sending SNI value that your backend requires, or there is some other SSL problem. Check your backend server log for details.

You may also capture the SSL handshake or run it through ssldump, to gain more information about it.

---

<div class="post-metadata">

**Author:** ![nick.t](https://avatars.discourse-cdn.com/v4/letter/n/9f8e36/32.png) [@nick.t](https://discourse.haproxy.org/u/nick.t)\
**Post date:** [July 5, 2017, 5:02pm UTC](https://discourse.haproxy.org/t/l6rsp-health-check-error-on-the-ssl-backend/1405/7 "2017-07-05T17:02:32Z")

</div>

You are right about SNI. If we use NGINX instead of IIS or disable SNI on the IIS it fix the L6 connection error.

Thank you so much!!

So, it seems haproxy doesn’t support SNI with backend connections? 0\_o

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 5, 2017, 5:42pm UTC](https://discourse.haproxy.org/t/l6rsp-health-check-error-on-the-ssl-backend/1405/8 "2017-07-05T17:42:07Z")

</div>

This should work:

`ssl verify required sni str(app1.example.com) verifyhost app1.example.com`

---

<div class="post-metadata">

**Author:** ![nick.t](https://avatars.discourse-cdn.com/v4/letter/n/9f8e36/32.png) [@nick.t](https://discourse.haproxy.org/u/nick.t)\
**Post date:** [July 6, 2017, 12:09pm UTC](https://discourse.haproxy.org/t/l6rsp-health-check-error-on-the-ssl-backend/1405/9 "2017-07-06T12:09:20Z")

</div>

Nope 🙂  
The only way is to disable SNI on the IIS side.

---

<div class="post-metadata">

**Author:** ![SolutionGuy](https://avatars.discourse-cdn.com/v4/letter/s/91b2a8/32.png) [@SolutionGuy](https://discourse.haproxy.org/u/SolutionGuy)\
**Post date:** [January 20, 2021, 11:53pm UTC](https://discourse.haproxy.org/t/l6rsp-health-check-error-on-the-ssl-backend/1405/10 "2021-01-20T23:53:34Z")

</div>

Hey Guys,

I encountered the same, the health check started to fail for an SSL enabled IIS backend, no changes made to the IIS config or HAProxy config recently. I tried disabling the health check and learned that it was only the health check failing, not even the basic TCP check would work. Probably an IIS quirk as when I disable health checking, traffic is sent to the same backend without any problems. Will try to upgrade to next HAProxy version and see if I get different behaviour. BTW, I do have SNI enabled on the backend and on IIS.

Version of HAProxy in use : 1.8.25 on pFsense 2.4.5

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [January 21, 2021, 6:54pm UTC](https://discourse.haproxy.org/t/l6rsp-health-check-error-on-the-ssl-backend/1405/11 "2021-01-21T18:54:11Z")

</div>

> [@SolutionGuy](#):
>
> not even the basic TCP check would work

That’s impossible, you probably didn’t fully removed all of the relevant health check configuration.

What’s missing in this thread is the `check-sni` configuration, so that a a static SNI value is used for health checks.

`check-sni www1.example.org`