Ssl – Nagios check_http gives ‘HTTP/1.0 503 Service Unavailable’ for HAProxy’d site

haproxyhttpnagiosssl

I asked this on stackoverflow, but I think it's better suited for here.

Can't figure this one out!

OS: CentOS 6.6 (Up-To-Date)

I get the following 503 error when using my nagios check_http check (or curl) to query an SSL site served via HAProxy 1.5.

[root@nagios ~]# /usr/local/nagios/libexec/check_http -v -H example.com -S1
GET / HTTP/1.1
User-Agent: check_http/v2.0 (nagios-plugins 2.0)
Connection: close
Host: example.com


https://example.com:443/ is 212 characters
STATUS: HTTP/1.0 503 Service Unavailable
**** HEADER ****
Cache-Control: no-cache
Connection: close
Content-Type: text/html
**** CONTENT ****
<html><body><h1>503 Service Unavailable</h1>
No server is available to handle this request.
</body></html>

HTTP CRITICAL: HTTP/1.0 503 Service Unavailable - 212 bytes in 1.076 second response time |time=1.075766s;;;0.000000 size=212B;;;0
[root@nagios ~]# curl -I https://example.com
HTTP/1.0 503 Service Unavailable
Cache-Control: no-cache
Connection: close
Content-Type: text/html

However. I can access the site fine via any browser; (200 OK), and also curl -I https://example.com from another server:

root@localhost:~# curl -I https://example.com
HTTP/1.1 200 OK
Date: Wed, 18 Feb 2015 14:36:51 GMT
Server: Apache/2.4.6
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Pragma: no-cache
Last-Modified: Wed, 18 Feb 2015 14:36:52 GMT
Content-Type: text/html; charset=UTF-8
Strict-Transport-Security: max-age=31536000;

The HAProxy server is runnning on pfSense 2.2.

I see that HAProxy returns an HTTP/1.0 for nagios and HTTP/1.1 from elsewhere. So is it my check_http plugin causing this or is it curl?

Is my server just not sending the HOST header? If so, how can I resolve this?

Best Answer

check_http has an option called --sni

You need to use that option

Related Topic