ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS

    ssl-default-bind-options no-sslv3

    tune.ssl.default-dh-param 2048   # dfd -- warning message

defaults

    log global

    mode    http

    option  httplog

    option  dontlognull

    option  forwardfor

    option  redispatch

    retries  3

        timeout connect 5000

        timeout client  15m

        timeout server  15m

    timeout http-request 10s

    timeout queue 1m

    timeout http-keep-alive 10s

    timeout check 10s

    errorfile 400 /etc/haproxy/errors/400.http

    errorfile 403 /etc/haproxy/errors/403.http

    errorfile 408 /etc/haproxy/errors/408.http

    errorfile 500 /etc/haproxy/errors/500.http

    errorfile 502 /etc/haproxy/errors/502.http

    errorfile 503 /etc/haproxy/errors/503.http

    errorfile 504 /etc/haproxy/errors/504.http

listen stats

    bind 10.1.252.4:7000

    #mode http

    stats enable

    stats uri /

    option httpclose

    stats auth Username:Password


frontend inet

    bind *:444 ssl crt /etc/ssl/certs/exchange_certificate_and_key_nopassword.pem

    #mode tcp

        mode http   # dfd

    default_backend inetservers444


backend inetservers444

    mode http

    balance roundrobin

    option httpchk GET /dfd/default.aspx

    option log-health-checks

    http-check expect status 200 OK

   # server theserver xxxxxx.xxxxxxx.xxx.com:443 check check-ssl inter 15s verify required ca-file/etc/haproxy/cert02Root.pem

    server theserver xxxxxx.xxxxxxx.xxx.com:80 check