Disable sslv3 from haproxy health check ssl-hello-chk

Question

I have a haproxy configures like below with health check. My backend doesn't support sslv3. Is there a way to make ssl-hello-chk to use a protocol other that sslv3.

backend am
  balance roundrobin
  mode http
  http-request set-header X-Forwarded-Port %[dst_port]
  http-request add-header X-Forwarded-Proto https if { ssl_fc }
  option ssl-hello-chk 
  option log-health-checks
  http-check expect rstatus 404
  server am-1 10.100.7.21:8243 check port 8243 inter 2000 rise 2 fall 5
  server am-2 10.100.7.21:8243 check port 8243 inter 2000 rise 2 fall 5

score 0 · Accepted Answer · answered Jun 09 '17 at 10:52

It is not supported to change the protocol other than sslv3 for ssl-hello-chk. Instead, you can use tcp-check on port 8243.

backend am
  balance roundrobin
  mode http
  http-request set-header X-Forwarded-Port %[dst_port]
  http-request add-header X-Forwarded-Proto https if { ssl_fc }
  option tcp-check
  server am-1 10.100.7.21:8243 ssl verify none check port 8243
  server am-2 10.100.7.21:8245 ssl verify none check port 8245

Disable sslv3 from haproxy health check ssl-hello-chk

1 Answers1