So I’ve split the configuration per IP. Each IP is still hosting multiple certificates, but with the most important one first, resulting to have SNI optional for the first domain.
I’ve cleared all traffic from HAProxy, making the logs pretty clean. After this I’ve ran ssllabs again, and this time, from the IP address of ssllabs, I see a lot of SSL handshake failure errors:Sep 5 14:14:02 loadbalancer haproxy[17372]: 64.41.200.103:59980 [05/Sep/2018:14:14:02.668] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:03 loadbalancer haproxy[17372]: 64.41.200.103:60088 [05/Sep/2018:14:14:03.015] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:03 loadbalancer haproxy[17372]: 64.41.200.103:60088 [05/Sep/2018:14:14:03.015] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:03 loadbalancer haproxy[17372]: 64.41.200.103:60184 [05/Sep/2018:14:14:03.366] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:03 loadbalancer haproxy[17372]: 64.41.200.103:60184 [05/Sep/2018:14:14:03.366] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:03 loadbalancer haproxy[17372]: 64.41.200.103:60280 [05/Sep/2018:14:14:03.719] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:03 loadbalancer haproxy[17372]: 64.41.200.103:60280 [05/Sep/2018:14:14:03.719] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:04 loadbalancer haproxy[17372]: 64.41.200.103:60384 [05/Sep/2018:14:14:04.067] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:04 loadbalancer haproxy[17372]: 64.41.200.103:60384 [05/Sep/2018:14:14:04.067] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:04 loadbalancer haproxy[17372]: 64.41.200.103:60479 [05/Sep/2018:14:14:04.417] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:04 loadbalancer haproxy[17372]: 64.41.200.103:60479 [05/Sep/2018:14:14:04.417] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:04 loadbalancer haproxy[17372]: 64.41.200.103:60566 [05/Sep/2018:14:14:04.765] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:04 loadbalancer haproxy[17372]: 64.41.200.103:60566 [05/Sep/2018:14:14:04.765] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:05 loadbalancer haproxy[17372]: 64.41.200.103:60654 [05/Sep/2018:14:14:05.116] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:05 loadbalancer haproxy[17372]: 64.41.200.103:60654 [05/Sep/2018:14:14:05.116] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:05 loadbalancer haproxy[17372]: 64.41.200.103:60748 [05/Sep/2018:14:14:05.465] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:05 loadbalancer haproxy[17372]: 64.41.200.103:60748 [05/Sep/2018:14:14:05.465] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:05 loadbalancer haproxy[17372]: 64.41.200.103:60834 [05/Sep/2018:14:14:05.815] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:05 loadbalancer haproxy[17372]: 64.41.200.103:60834 [05/Sep/2018:14:14:05.815] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:06 loadbalancer haproxy[17372]: 64.41.200.103:60936 [05/Sep/2018:14:14:06.168] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:06 loadbalancer haproxy[17372]: 64.41.200.103:60936 [05/Sep/2018:14:14:06.168] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:06 loadbalancer haproxy[17372]: 64.41.200.103:32804 [05/Sep/2018:14:14:06.518] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:06 loadbalancer haproxy[17372]: 64.41.200.103:32804 [05/Sep/2018:14:14:06.518] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:07 loadbalancer haproxy[17372]: 64.41.200.103:32900 [05/Sep/2018:14:14:06.869] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:07 loadbalancer haproxy[17372]: 64.41.200.103:32900 [05/Sep/2018:14:14:06.869] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:07 loadbalancer haproxy[17372]: 64.41.200.103:32990 [05/Sep/2018:14:14:07.228] secure-http-in-traffic/3: SSL handshake failure
Sep 5 14:14:07 loadbalancer haproxy[17372]: 64.41.200.103:32990 [05/Sep/2018:14:14:07.228] secure-http-in-traffic/3: SSL handshake failure
The results of SSL Labs say that most browsers are supported, so I wonder what the handshake failure errors are for? We still got the feeling something is ‘wrong’, but there’s no signs anywhere.