TLS ServerName extension during ssl-hello-chk

[jnitecki]

Hello,

My backend server requires servername extension to be included during ClientHello message. I’m using transparent load balancing via HAProxy and it works, but health checks can run only in tcp mode. Enabling ssl-hello-check fails as no server name extension is provided and server closes connection without responding with ServerHello.

Following OpenSSL commands can be used to illustrate what I need:
openssl s_client -servername x.y.z -connect a.b.c.d:443 WORKS
openssl s_client -connect a.b.c.d:443 FAILS HANDSHAKE identically to HAProxy ssl-hello-check

What option shall I use in HAProxy to make it work? I’m using version 1.5.14

Jan

[lukastribus]

In haproxy 1.6 release we can send a certain SNI value, but not when health checking:

Can 1.6 do SNI on backend?

Thanks for the clarification. I was so focused on the health checks failing that I did not consider that it would work without the health check. I’ll document this thread and issue a ticket. –Ray

You will have to use an external check for this:
https://cbonte.github.io/haproxy-dconv/1.6/configuration.html#external-check%20(Process%20management%20and%20security)

[rgacote]

Thanks for the update on this.
I look forward to exploring the external health check functionality.