<p>Initialy i test with mode tcp and that works. The haproxy tcp passthru config is below:</p>

<pre><code>frontend https_in
        bind *:443
        mode tcp
        option forwardfor
        option tcplog
        log global
        default_backend https_backend

backend https_backend
        mode tcp
        server s1 10.21.0.60:31390 check
        server s2 10.21.0.169:31390 check
        server s3 10.21.0.173:31390 check
</code></pre>

<p>How should a mode http configuration look like? I need to decrypt traffic, inject some headers (like forwarded-for) and encrypt it again, sending it to ssl istio ingress-gateway backend.</p>

<p>My configuration attempts were many (and unsuccessful) here is one snapshot:</p>

<pre><code>frontend https_in
    mode http
    bind *:443 ssl crt /etc/haproxy/prod.pem crt /etc/haproxy/dev.pem crt /etc/haproxy/stg.pem no-sslv3

    option http-server-close
    option forwardfor
    reqadd X-Forwarded-Proto:\ https
    reqadd X-Forwarded-Port:\ 443

    rspadd  Strict-Transport-Security:\ max-age=15768000

    tcp-request inspect-delay 5s
    tcp-request content accept if { req_ssl_hello_type 1 }
    acl acl_app1 req_ssl_sni -i mydomain.test
    use_backend https_backend if acl_app1

backend https_backend
    mode http
    server s1 10.21.0.60:31390 check ssl verify none
</code></pre>

<p>In haproxy logs i see</p>

<pre><code>haproxy[12734]: Server https_backend/s1 is DOWN, reason: Layer6 invalid response, info: "SSL handshake failure (Connection reset by peer)", check duration: 1ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
haproxy[12734]: Server https_backend/s1 is DOWN, reason: Layer6 invalid response, info: "SSL handshake failure (Connection reset by peer)", check duration: 1ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
haproxy[12734]: backend https_backend has no server available!
</code></pre>

<p>If i remove the check, and still try to query haproxy:</p>

<pre><code>haproxy[13381]: https_in~ https_in/&lt;NOSRV&gt; -1/-1/-1/-1/0 503 213 - - SC-- 1/1/0/0/0 0/0 "GET / HTTP/1.1"
</code></pre>

<p>I cannot figure the SNI settings to pass from haproxy into istio to make it work.</p>

<p>I cannot find anything usefull in logs from envoyproxy and istio-ingressgateway on debug loglevel either.</p>

<p>It's been a while since you posted this problem, but I encountered the same issue. So I was able to verify the HAProxy error using the <code>openssl s_client</code> command.</p>
<p><code>openssl s_client -connect ip:port</code> would return a <code>write:errno=104</code> which means it's a <code>Connection reset by peer</code> error.</p>
<p>But when I supplied the server name, I was able to successfully connect to the backend: <code>openssl s_client -connect ip:port -servername server.name</code>.</p>
<p>After digging around in the backend option from HAProxy, I stumbled on the <a href="https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#5.2-check-sni" rel="nofollow noreferrer">check-sni</a> option, which mentions:</p>
<blockquote>
<p>This option allows you to specify the SNI to be used when doing health checks
over SSL. It is only possible to use a string to set . ...</p>
</blockquote>
<p>So I use this option to configure the backend server as follows</p>
<pre><code>server lokomotive-contour ip:port ssl verify none check-sni server.name sni str(server.name) check
</code></pre>
<p>The critical part is the <code>check-sni</code> option like mentioned before; this configures the SNI during the health checks.</p>
<p>But I also found the <code>sni str()</code> option to be necessary for getting the regular traffic routing through this backend to work properly.</p>
<p>ps: make sure you are on HAProxy 1.8 or later since the <code>check-sni</code> is only supported starting from 1.8 😉</p>
<p>Hope my answer can help you in the future</p>
