# Tcp mode and ssl confusion

**URL:** https://discourse.haproxy.org/t/tcp-mode-and-ssl-confusion/7956
**Category:** Help!
**Created:** [September 14, 2022, 3:00pm UTC](https://discourse.haproxy.org/t/tcp-mode-and-ssl-confusion/7956 "2022-09-14T15:00:57Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![marypoppins](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@marypoppins](https://discourse.haproxy.org/u/marypoppins)
#### Post date: [September 14, 2022, 3:00pm UTC](https://discourse.haproxy.org/t/tcp-mode-and-ssl-confusion/7956/1 "2022-09-14T15:00:57Z")

</div>

Dear All,

Is it reasonable to use ssl on the frontend in tcp mode?  
I found a configuration like this:

listen service\_https  
bind :443 ssl crt domain.pem  
mode tcp  
option tcp-check  
server srv1 \<backend\_ip1\>:3000 check inter 1s weight 1  
server srv2 \<backend\_ip2\>:3000 check inter 1s weight 1

The “mode tcp” dictates that the frontend and backend is in tcp mode, as I think in this mode the haproxy simply pass the tcp packets to the backends, and doesn’t care about the above tls/ssl protocol.  
However the bind use the ssl option. The admin page shows : “cap proxy, mode:tcp”

So if the frontend use ssl option, shouldn’t the mode be in http mode?

PS: sorry for bad english

thank you

---

<div class="post-metadata">

### Author: ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [September 14, 2022, 3:36pm UTC](https://discourse.haproxy.org/t/tcp-mode-and-ssl-confusion/7956/2 "2022-09-14T15:36:39Z")

</div>

This is a valid configuration if that is what you want.

What it is doing specifically is:

Decrypt SSL on the frontend and pass cleartext, unencrypted payload to the backend.

So in other words, you’d have a client with a TCP based protocol but protected by SSL, while the server only handles cleartext unencrypted traffic.

It could be HTTPS → HTTP, but it could also another protocol with implicit SSL.

---

<div class="post-metadata">

### Author: ![marypoppins](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@marypoppins](https://discourse.haproxy.org/u/marypoppins)
#### Post date: [September 14, 2022, 10:46pm UTC](https://discourse.haproxy.org/t/tcp-mode-and-ssl-confusion/7956/3 "2022-09-14T22:46:13Z")

</div>

Thank you for the answer.  
So the mode and using ssl (at frontend or backend) is two independent things. If you use ssl at the frontend, then hapo will use it. If you use ssl at the backend haproxy will use it. The mode (tcp or http) always match at the two side of haproxy, and the tcp mode just a layer4 forwarding, while http mode required if you want to modify/analyze the http stream.  
And that supposal that the frontend ssl won’t work in tcp mode (because tcp mode is care about layer 4 only) is completely wrong.  
Thank you

---

<div class="post-metadata">

### Author: ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [September 16, 2022, 6:20pm UTC](https://discourse.haproxy.org/t/tcp-mode-and-ssl-confusion/7956/4 "2022-09-16T18:20:30Z")

</div>

Yes, correct.

---

<div class="post-metadata">

### Author: ![marypoppins](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@marypoppins](https://discourse.haproxy.org/u/marypoppins)
#### Post date: [September 20, 2022, 9:10am UTC](https://discourse.haproxy.org/t/tcp-mode-and-ssl-confusion/7956/5 "2022-09-20T09:10:25Z")

</div>

Thank you very much!