# Moving SSL termination from web server to HAProxy - L7 Timeout

**URL:** https://discourse.haproxy.org/t/moving-ssl-termination-from-web-server-to-haproxy-l7-timeout/2739
**Category:** Help!
**Created:** [July 17, 2018, 11:29am UTC](https://discourse.haproxy.org/t/moving-ssl-termination-from-web-server-to-haproxy-l7-timeout/2739 "2018-07-17T11:29:32Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![kingsloi](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/kingsloi/32/544_2.png) [@kingsloi](https://discourse.haproxy.org/u/kingsloi)
#### Post date: [July 17, 2018, 11:29am UTC](https://discourse.haproxy.org/t/moving-ssl-termination-from-web-server-to-haproxy-l7-timeout/2739/1 "2018-07-17T11:29:32Z")

</div>

Hi,

I’m sure it’s something that I am overseeing.

I am moving from my web servers (apache/httpd) handling ssl termination, and instead handling ssl termination on the HAProxy instance instead. I already have the same setup for a different site of mine with HAProxy, but with nginx as my web server, and that works perfectly. I’ve copied the working config, but switched out the ip/addresses but to no avail.

Here’s my config:  
[https://hastebin.com/oxademeqar.pl](https://hastebin.com/oxademeqar.pl)

Here’s my status page:  
[https://imgur.com/5xIQXsT](https://imgur.com/5xIQXsT)

I have disabled the http -\> https redirect on my web server, and instead just have a standalone vhost (I can post here if needed).

Any advice would be much, much appreciated!

---

<div class="post-metadata">

### Author: ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [July 17, 2018, 11:52am UTC](https://discourse.haproxy.org/t/moving-ssl-termination-from-web-server-to-haproxy-l7-timeout/2739/2 "2018-07-17T11:52:01Z")

</div>

Your health check fails with L7TOUT, meaning a layer 7 timeout.

Make sure your backend server responds to the healthcheck request coming from haproxy. Maybe tcpdump and checkout what happens at layer 7, and chechkout backend logs.
