HAProxy 检查端口 443

Question

是否可以让 HAProxy 对 SSL/端口 443 端点进行健康检查？

下面check port 443的配置中的健康检查失败

HAProxy 配置如下

global
    log         127.0.0.1 local2

    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     50000
    user        haproxy
    group       haproxy
    daemon

    # turn on stats unix socket
    stats socket /var/lib/haproxy/stats

defaults
    mode                    tcp
    log                     global
    option                  dontlognull
    retries                 3
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout check           5s
    maxconn                 15000


#---------------------------------------------------------------------
# status page.
#---------------------------------------------------------------------
listen stats 0.0.0.0:8000
    mode http
    stats enable
    stats uri /haproxy
    stats realm HAProxy

#---------------------------------------------------------------------
# Incoming HTTP -> Admin Redirect Proxy rule
#--------------------------------------------------------------------
listen RedirectToHttps
    mode http
    bind :80
    redirect location https://admin.example.com code 301

#---------------------------------------------------------------------
# Incoming HTTPS -> Admin Proxy rule
#---------------------------------------------------------------------
listen ToHttps
    mode tcp
    bind :443
    option ssl-hello-chk
    balance roundrobin
    option httpchk GET /heartbeat.php HTTP/1.1\r\nHost:\ admin.example.com
    server admin-no-check-test     ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 maxconn 5000
    server admin-150-checkport-80  ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 check port 80 maxconn 5000
    server admin-150-checkport-443 ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 check port 443 maxconn 5000

Answer 1

我相信option ssl-hello-chk和option httpchk是两种不同类型的检查，但 HAProxy 只允许您一次使用一种。您应该选择ssl-hello-chk仅检查 SSL 是否存在，或使用httpchk检查特定 URI，但不能同时检查两者。