# Trouble of interconnecting haproxy via https **URL:** \ **Category:** Help!\ **Created:** [January 26, 2026, 12:57pm UTC](https://discourse.haproxy.org/t/trouble-of-interconnecting-haproxy-via-https/12119 "2026-01-26T12:57:55Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![luke](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@luke](https://discourse.haproxy.org/u/luke)\ **Post date:** [January 26, 2026, 12:57pm UTC](https://discourse.haproxy.org/t/trouble-of-interconnecting-haproxy-via-https/12119/1 "2026-01-26T12:57:55Z")
Hello, I have two haproxys, with configuration like: frontend-haproxy: ```auto global master-worker log stderr local1 defaults mode http log global option httpslog frontend http-frontend bind 10.0.139.144:8080 default_backend luke backend luke server luke 10.0.139.144:21443 ssl verify required verifyhost 10.0.139.144 ca-file ca.pem crl-file crl.pem ``` backend-haproxy.cfg: ```auto global master-worker log stderr local1 defaults log global mode http option httpslog frontend https bind 10.0.139.144:21443 ssl crt bundle.pem alpn h2 ``` The provided bundle verifies against the CA: `openssl verify -CAfile ca.pem bundle.pem` `bundle.pem: OK` Also when I use curl to access the backend-haproxy it work well: ```auto curl -v --cacert ca.pem https://10.0.139.144:21443/ * Trying 10.0.139.144:21443... * ALPN: curl offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * SSL Trust Anchors: * CAfile: ca.pem * CApath: /opt/slapgrid/shared/openssl-3.5/2f7e00a8b6299d8d384f8bcd1add06a4/etc/ssl/certs * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / RSASSA-PSS * ALPN: server accepted h2 * Server certificate: * subject: O=rapid-cdn 001 @ COMP-4338; OU=caddy-frontend-1; CN=10.0.139.144 * start date: Jan 14 14:03:59 2026 GMT * expire date: Apr 17 14:03:59 2026 GMT * issuer: CN=Caucase CAS at 10.0.139.144:8990 * Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption * Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption * common name: 10.0.139.144 (matched) * SSL certificate verified via OpenSSL. * Established connection to 10.0.139.144 (10.0.139.144 port 21443) from 10.0.139.144 port 34492 * using HTTP/2 * [HTTP/2] [1] OPENED stream for https://10.0.139.144:21443/ * [HTTP/2] [1] [:method: GET] * [HTTP/2] [1] [:scheme: https] * [HTTP/2] [1] [:authority: 10.0.139.144:21443] * [HTTP/2] [1] [:path: /] * [HTTP/2] [1] [user-agent: curl/8.17.0] * [HTTP/2] [1] [accept: */*] > GET / HTTP/2 > Host: 10.0.139.144:21443 > User-Agent: curl/8.17.0 > Accept: */* > * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): * Request completely sent off < HTTP/2 503 < content-length: 107 < cache-control: no-cache < content-type: text/html <

503 Service Unavailable

No server is available to handle this request. * Connection #0 to host 10.0.139.144:21443 left intact ``` But when I access it from the frontend haproxy like: curl [http://10.0.139.144:8080/](http://10.0.139.144:8080/) Then frontend haproxy logs: ```auto 00000003:http-frontend.accept(0005)=001e from [10.0.139.144:37720] ALPN= 00000003:http-frontend.clireq[001e:ffffffff]: GET / HTTP/1.1 00000003:http-frontend.clihdr[001e:ffffffff]: host: 10.0.139.144:8080 00000003:http-frontend.clihdr[001e:ffffffff]: user-agent: curl/8.17.0 00000003:http-frontend.clihdr[001e:ffffffff]: accept: */* [03|ssl|0|l_sock.c:5621] Other error fd[0x1f] OpenSSL error[0xa000086] tls_post_process_server_certificate: certificate verify failed [03|ssl|0|l_sock.c:5695] handshake error [03|ssl|0|l_sock.c:5621] Other error fd[0x1f] OpenSSL error[0xa000086] tls_post_process_server_certificate: certificate verify failed [03|ssl|0|l_sock.c:5695] handshake error [03|ssl|0|l_sock.c:5621] Other error fd[0x1f] OpenSSL error[0xa000086] tls_post_process_server_certificate: certificate verify failed [03|ssl|0|l_sock.c:5695] handshake error [03|ssl|0|l_sock.c:5621] Other error fd[0x1f] OpenSSL error[0xa000086] tls_post_process_server_certificate: certificate verify failed [03|ssl|0|l_sock.c:5695] handshake error 00000003:luke.clicls[001e:001f] 00000003:luke.closed[001e:001f] <142>Jan 26 13:53:43 haproxy[4147653]: 10.0.139.144:37720 [26/Jan/2026:13:53:40.642] http-frontend luke/luke 0/0/-1/-1/3028 503 217 - - SC-- 1/1/0/0/3 0/0 "GET / HTTP/1.1" 0/-/-/-/0 -/-/- ``` And in the backend haproxy I have: `[07|ssl|0|l_sock.c:5621] Other error` `fd[0x1e] OpenSSL error[0xa000418] ssl3_read_bytes: tlsv1 alert unknown ca` `[07|ssl|0|l_sock.c:5695] handshake error` `<142>Jan 26 13:53:40 haproxy[4147668]: 10.0.139.144:55692 [26/Jan/2026:13:53:40.643] https/1: SSL handshake failure (error:0A000418:SSL routines::tlsv1 alert unknown ca)` `[00|ssl|0|l_sock.c:5695] handshake error` `<142>Jan 26 13:53:41 haproxy[4147668]: 10.0.139.144:55694 [26/Jan/2026:13:53:41.649] https/1: SSL handshake failure` `[01|ssl|0|l_sock.c:5621] Other error` `fd[0x1e] OpenSSL error[0xa000418] ssl3_read_bytes: tlsv1 alert unknown ca` `[01|ssl|0|l_sock.c:5695] handshake error` `<142>Jan 26 13:53:42 haproxy[4147668]: 10.0.139.144:55698 [26/Jan/2026:13:53:42.661] https/1: SSL handshake failure (error:0A000418:SSL routines::tlsv1 alert unknown ca)` `[02|ssl|0|l_sock.c:5695] handshake error` `<142>Jan 26 13:53:43 haproxy[4147668]: 10.0.139.144:33832 [26/Jan/2026:13:53:43.668] https/1: SSL handshake failure` My haproxy is: ```auto HAProxy version 3.2.10-35a71a0 2025/12/18 - https://haproxy.org/ Status: long-term supported branch - will stop receiving fixes around Q2 2030. Known bugs: http://www.haproxy.org/bugs/bugs-3.2.10.html Running on: Linux 6.1.0-42-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.159-1 (2025-12-30) x86_64 Build options : TARGET = linux-glibc CC = cc CFLAGS = -O2 -m64 -fwrapv -fvect-cost-model=very-cheap OPTIONS = USE_OPENSSL=1 USE_LUA=1 USE_ZLIB=1 USE_DL=1 USE_QUIC=1 USE_PROMEX=1 USE_PCRE=1 DEBUG = Feature list : -51DEGREES +ACCEPT4 +BACKTRACE -CLOSEFROM +CPU_AFFINITY +CRYPT_H -DEVICEATLAS +DL -ENGINE +EPOLL -EVPORTS +GETADDRINFO -KQUEUE -LIBATOMIC +LIBCRYPT +LINUX_CAP +LINUX_SPLICE +LINUX_TPROXY +LUA +MATH -MEMORY_PROFILING +NETFILTER +NS -OBSOLETE_LINKER +OPENSSL -OPENSSL_AWSLC -OPENSSL_WOLFSSL -OT +PCRE -PCRE2 -PCRE2_JIT -PCRE_JIT +POLL +PRCTL -PROCCTL +PROMEX -PTHREAD_EMULATION +QUIC -QUIC_OPENSSL_COMPAT +RT -SLZ +SSL -STATIC_PCRE -STATIC_PCRE2 +TFO +THREAD +THREAD_DUMP +TPROXY -WURFL +ZLIB +ACME Default settings : bufsize = 16384, maxrewrite = 1024, maxpollevents = 200 Built with multi-threading support (MAX_TGROUPS=32, MAX_THREADS=1024, default=8). Built with SSL library version : OpenSSL 3.5.4 30 Sep 2025 Running on SSL library version : OpenSSL 3.5.4 30 Sep 2025 SSL library supports TLS extensions : yes SSL library supports SNI : yes SSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3 OpenSSL providers loaded : default QUIC: connection socket-owner mode support : yes QUIC: GSO emission support : yes Built with Lua version : Lua 5.4.8 Built with the Prometheus exporter as a service Built with network namespace support. Built with zlib version : 1.3.1 Running on zlib version : 1.3.1 Compression algorithms supported : identity(“identity”), deflate(“deflate”), raw-deflate(“deflate”), gzip(“gzip”) Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND Built with PCRE version : 8.45 2021-06-15 Running on PCRE version : 8.45 2021-06-15 PCRE library supports JIT : no (USE_PCRE_JIT not set) Encrypted password support via crypt(3): yes Built with gcc compiler version 12.2.0 Available polling systems : epoll : pref=300, test result OK poll : pref=200, test result OK select : pref=150, test result OK Total: 3 (3 usable), will use epoll. Available multiplexer protocols : (protocols marked as cannot be specified using ‘proto’ keyword) quic : mode=HTTP side=FE mux=QUIC flags=HTX|NO_UPG|FRAMED h2 : mode=HTTP side=FE|BE mux=H2 flags=HTX|HOL_RISK|NO_UPG : mode=HTTP side=FE|BE mux=H1 flags=HTX h1 : mode=HTTP side=FE|BE mux=H1 flags=HTX|NO_UPG fcgi : mode=HTTP side=BE mux=FCGI flags=HTX|HOL_RISK|NO_UPG : mode=SPOP side=BE mux=SPOP flags=HOL_RISK|NO_UPG spop : mode=SPOP side=BE mux=SPOP flags=HOL_RISK|NO_UPG : mode=TCP side=FE|BE mux=PASS flags= none : mode=TCP side=FE|BE mux=PASS flags=NO_UPG Available services : prometheus-exporter Available filters : [BWLIM] bwlim-in [BWLIM] bwlim-out [CACHE] cache [COMP] compression [FCGI] fcgi-app [SPOE] spoe [TRACE] trace ``` I’ve started those with options: `-d -V -dt -dD` In order to produce those logs. Is it a haproxy problem? Did I made an obvious mistake? My use case is to interconnect my various haproxy with certiifcate from our own CA. Note: I used certificate from letsencrypt in the backend haproxy, and I used @system-ca for verification in the frontend haproxy, but I got same result. Regards, Łukasz ---
**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\ **Post date:** [January 26, 2026, 1:26pm UTC](https://discourse.haproxy.org/t/trouble-of-interconnecting-haproxy-via-https/12119/2 "2026-01-26T13:26:05Z")
In certificates, only [dNSName](https://datatracker.ietf.org/doc/html/rfc5280#page-38)’s are supported, not IP addresses. Also see: > > > \### Detailed Description of the Problem > > \`echo "show ssl cert /etc/haproxy/ssl/c…ert.pem" | socat /var/run/haproxy-admin.sock -\` > > will show the following output for a certificate with IP address in SAN: > > \`\`\` > Status: Used > ... > notBefore: Jan 17 15:52:03 2026 GMT > notAfter: Jan 24 07:52:02 2026 GMT > Subject Alternative Name: > Algorithm: EC256 > ... > Subject: > Issuer: /C=US/O=Let's Encrypt/CN=YE1 > Chain Subject: /C=US/O=Let's Encrypt/CN=YE1 > Chain Issuer: /C=US/O=ISRG/CN=Root YE > Chain Subject: /C=US/O=ISRG/CN=Root YE > Chain Issuer: /C=US/O=Internet Security Research Group/CN=ISRG Root X2 > Chain Subject: /C=US/O=Internet Security Research Group/CN=ISRG Root X2 > Chain Issuer: /C=US/O=Internet Security Research Group/CN=ISRG Root X1 > OCSP Response Key: > > \`\`\` > > \### Expected Behavior > > IP address is displayed in "Subject Alternative Name:" line. > > \### Steps to Reproduce the Behavior > > Aquire a certificate from \[Lets Encrypt\](https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability) (or some other provider) with an IP-Address in the Subjet Alternative Name. > > \`echo "show ssl cert /etc/haproxy/ssl/cert.pem" | socat /var/run/haproxy-admin.sock -\` > > Observe output. > > \### Do you have any idea what may have caused this? > > Probably in \`ssl\_sock\_get\_san\_oneline\` https://github.com/haproxy/haproxy/blob/90c5618ed5f460fe659f21b3c7f047f400f26936/src/ssl\_ckch.c#L1932 > > > > \### Do you have an idea how to solve the issue? > > \_No response\_ > > \### What is your configuration? > > \`\`\`haproxy > global > ca-base /etc/ssl/certs > chroot /var/lib/haproxy > crt-base /etc/ssl/private > daemon > group haproxy > log /dev/log local0 > maxconn 4096 > pidfile /var/run/haproxy.pid > ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 > ssl-default-bind-ciphersuites TLS\_AES\_128\_GCM\_SHA256:TLS\_AES\_256\_GCM\_SHA384:TLS\_CHACHA20\_POLY1305\_SHA256 > ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 > > ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 > ssl-default-server-ciphersuites TLS\_AES\_128\_GCM\_SHA256:TLS\_AES\_256\_GCM\_SHA384:TLS\_CHACHA20\_POLY1305\_SHA256 > ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 > > stats socket /run/haproxy-admin.sock level admin mode 0600 > tune.ssl.default-dh-param 2048 > user haproxy > \`\`\` > > \### Output of \`haproxy -vv\` > > \`\`\`plain > HAProxy version 3.3.1-1~bpo13+1 2025/12/20 - https://haproxy.org/ > Status: stable branch - will stop receiving fixes around Q1 2027. > Known bugs: http://www.haproxy.org/bugs/bugs-3.3.1.html > Running on: Linux 6.12.63+deb13-amd64 #1 SMP PREEMPT\_DYNAMIC Debian 6.12.63-1 (2025-12-30) x86\_64 > Build options : > TARGET = linux-glibc > CC = x86\_64-linux-gnu-gcc > CFLAGS = -O2 -g -fwrapv -fvect-cost-model=very-cheap -g -O2 -Werror=implicit-function-declaration -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wdate-time -D\_FORTIFY\_SOURCE=2 > OPTIONS = USE\_OPENSSL=1 USE\_LUA=1 USE\_SLZ=1 USE\_OT=1 USE\_QUIC=1 USE\_PROMEX=1 USE\_PCRE2=1 USE\_PCRE2\_JIT=1 > DEBUG = > > Feature list : -51DEGREES +ACCEPT4 +BACKTRACE -CLOSEFROM +CPU\_AFFINITY +CRYPT\_H -DEVICEATLAS +DL -ECH -ENGINE +EPOLL -EVPORTS +GETADDRINFO -KQUEUE +KTLS -LIBATOMIC +LIBCRYPT +LINUX\_CAP +LINUX\_SPLICE +LINUX\_TPROXY +LUA +MATH -MEMORY\_PROFILING +NETFILTER +NS -OBSOLETE\_LINKER +OPENSSL -OPENSSL\_AWSLC -OPENSSL\_WOLFSSL +OT -PCRE +PCRE2 +PCRE2\_JIT -PCRE\_JIT +POLL +PRCTL -PROCCTL +PROMEX -PTHREAD\_EMULATION +QUIC -QUIC\_OPENSSL\_COMPAT +RT +SHM\_OPEN +SLZ +SSL -STATIC\_PCRE -STATIC\_PCRE2 +TFO +THREAD +THREAD\_DUMP +TPROXY -WURFL -ZLIB +ACME > > Default settings : > bufsize = 16384, maxrewrite = 1024, maxpollevents = 200 > > Built with multi-threading support (MAX\_TGROUPS=32, MAX\_THREADS=1024, default=4). > Built with SSL library version : OpenSSL 3.5.4 30 Sep 2025 > Running on SSL library version : OpenSSL 3.5.4 30 Sep 2025 > SSL library supports TLS extensions : yes > SSL library supports SNI : yes > SSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3 > OpenSSL providers loaded : default > QUIC: connection sock-per-conn mode support : yes > QUIC: GSO emission support : yes > Built with Lua version : Lua 5.4.7 > Built with the Prometheus exporter as a service > Built with network namespace support. > Built with OpenTracing support. > Built with libslz for stateless compression. > Compression algorithms supported : identity("identity"), deflate("deflate"), raw-deflate("deflate"), gzip("gzip") > Built with transparent proxy support using: IP\_TRANSPARENT IPV6\_TRANSPARENT IP\_FREEBIND > Built with PCRE2 version : 10.46 2025-08-27 > PCRE2 library supports JIT : yes > Encrypted password support via crypt(3): yes > Built with gcc compiler version 14.2.0 > > Available polling systems : > epoll : pref=300, test result OK > poll : pref=200, test result OK > select : pref=150, test result OK > Total: 3 (3 usable), will use epoll. > > Available multiplexer protocols : > (protocols marked as \ cannot be specified using 'proto' keyword) > quic : mode=HTTP side=FE|BE mux=QUIC flags=HTX|NO\_UPG|FRAMED > h2 : mode=HTTP side=FE|BE mux=H2 flags=HTX|HOL\_RISK|NO\_UPG > \ : mode=HTTP side=FE|BE mux=H1 flags=HTX > h1 : mode=HTTP side=FE|BE mux=H1 flags=HTX|NO\_UPG > fcgi : mode=HTTP side=BE mux=FCGI flags=HTX|HOL\_RISK|NO\_UPG > \ : mode=SPOP side=BE mux=SPOP flags=HOL\_RISK|NO\_UPG > spop : mode=SPOP side=BE mux=SPOP flags=HOL\_RISK|NO\_UPG > \ : mode=TCP side=FE|BE mux=PASS flags= > none : mode=TCP side=FE|BE mux=PASS flags=NO\_UPG > > Available services : prometheus-exporter > Available filters : > \[BWLIM\] bwlim-in > \[BWLIM\] bwlim-out > \[CACHE\] cache > \[COMP\] compression > \[FCGI\] fcgi-app > \[OT\] opentracing > \[SPOE\] spoe > \[TRACE\] trace > \`\`\` > > \### Last Outputs and Backtraces > > \`\`\`plain > > \`\`\` > > \### Additional Information > > \_No response\_ ---
**Author:** ![luke](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@luke](https://discourse.haproxy.org/u/luke)\ **Post date:** [January 26, 2026, 4:10pm UTC](https://discourse.haproxy.org/t/trouble-of-interconnecting-haproxy-via-https/12119/3 "2026-01-26T16:10:24Z")
Hello, > [@lukastribus](#): > > In certificates, only [dNSName](https://datatracker.ietf.org/doc/html/rfc5280#page-38)’s are supported, not IP addresses. Excellent point! I just used my own name for the other tool and used verifyhost directive. Thanks!