With `ssl` set on the `server` option, HAProxy strips the TLS protocol
for all clients. You would need to connect to it with `http://<ip>:443`.
To have an active health check, which uses SSL, but does not strip it
for clients, you'd need to add:
- `check` to enable active health checks.
- `check-ssl` to instruct the health check to use TLS
- `verify none` to skip verification on the health check requests from
HAProxy
- _REMOVE_ `ssl` to stop stripping TLS
The active health checks are required to not route any requests to the
inactive managers. These would redirect to any unusable IP from the
active mgr.
---
Alternatively you could add another certificate in the frontend and then
re-encrypt the traffic. But this would require tracking the certs also
in HAProxy.