Serving LDAPS lookups over HAProxy, unable to bind in testing - ssl

Question

So I've got a sub-domain with a DC that I'm trying to setup HAProxy for SSL termination. So my problem is HAProxy is giving an error in LDP.exe when trying to connect and bind to *ldaps.**tech.com:
Server error: <empty>
53 = ldap_set_option(ld, LDAP_OPT_ENCRYPT, 1)
res = ldap_bind_s(ld, NULL, &NtAuthIdentity, NEGOTIATE (1158)); // v.3
{NtAuthIdentity: User='bh-test'; Pwd=<unavailable>; domain = '****tech.com'}
Error <81>: ldap_bind_s() failed: Server Down.
Server error: <empty>
I'm able to ping the server just fine, and port 636 is open and waiting. And I'm using creds from a user with Domain Admin perms on that domain.
the HAProxy server is actually feeding two domains with ACLs and the other domain works perfectly.
Here is my Haproxy.cfg:
global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 660 level admin
stats timeout 30s
maxconn 2048
user haproxy
group haproxy
daemon
# Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
# Default ciphers to use on SSL-enabled listening sockets.
# For more information, see ciphers(1SSL). This list is from:
# https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
# An alternative list with additional directives can be obtained from
# https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
ssl-default-bind-options no-sslv3
tune.ssl.default-dh-param 2048
defaults
log global
mode http
option httplog
option dontlognull
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
# Enabling HAProxy Stats
listen stats
bind :8404
mode http
log global
maxconn 10
stats enable
stats refresh 30s
stats show-node
stats auth user:password
stats uri /haproxy?stats
# LDAPS
frontend ldaps_frontend
mode tcp
log global
bind *:636 ssl crt /etc/ssl/private/hap/
description LDAPS Service
option tcplog
option logasap
option socket-stats
option tcpka
timeout client 60s
acl host_j hdr(host) -i j.com
acl host_*** hdr(host) -i ***tech.com
use_backend j_ldaps if host_j
use_backend e*** if host_***
# Enzian Stuff
frontend https-in
bind *:443 ssl crt /etc/ssl/private/hap/
mode http
description ***Tech
option socket-stats
default_backend ***_https
option tcplog
backend j_ldaps
mode tcp
balance leastconn
server dc01 x.x.x.x:636 maxconn 100 check ssl fall 1 rise 1 inter 2s verify none check check-ssl
server dc02 x.x.x.x:636 maxconn 100 check ssl fall 1 rise 1 inter 2s verify none check check-ssl
timeout server 60s
timeout connect 60s
option tcpka
option tcp-check
tcp-check connect port 636 ssl
tcp-check send-binary 300c0201 # LDAP bind request "<ROOT>" simple
tcp-check send-binary 01 # message ID
tcp-check send-binary 6007 # protocol Op
tcp-check send-binary 0201 # bind request
tcp-check send-binary 03 # LDAP v3
tcp-check send-binary 04008000 # name, simple authentication
tcp-check expect binary 0a0100 # bind response + result code: success
tcp-check send-binary 30050201034200 # unbind request
backend ***
mode tcp
balance leastconn
# server dc01.***tech.com x.x.x.x:636 maxconn 100 check ssl fall 1 rise 1 inter 2s verify none check check-ssl
server dc02.***tech.com x.x.x.x:636 maxconn 100 check ssl fall 1 rise 1 inter 2s verify none check check-ssl
timeout server 60s
timeout connect 60s
option tcpka
option tcp-check
tcp-check connect port 636 ssl
tcp-check send-binary 300c0201 # LDAP bind request "<ROOT>" simple
tcp-check send-binary 01 # message ID
tcp-check send-binary 6007 # protocol Op
tcp-check send-binary 0201 # bind request
tcp-check send-binary 03 # LDAP v3
tcp-check send-binary 04008000 # name, simple authentication
tcp-check expect binary 0a0100 # bind response + result code: success
tcp-check send-binary 30050201034200 # unbind request
backend ***_https
mode http
balance leastconn
server subca02.***tech.com x.x.x.x:443 maxconn 100 check ssl fall 1 rise 1 inter 2s verify none check check-ssl
# server dc01.***tech.com x.x.x.x:636 maxconn 100 check ssl fall 1 rise 1 inter 2s verify none check check-ssl
option httpchk OPTIONS / HTTP/1.1
The credentials used have been dbl-checked, there is no local firewall on this DC, no firewalls between either host so I'm rather lost.
Any advice is appreciated!!

Answer 1

The hdr(host) ist for http workload and makes no sends with mode tcp.
hdr()
I would try to use req.ssl_sni for routing as described in How does the SNI Routing works in HAProxy and Enhanced SSL Load Balancing with Server Name Indication (SNI) TLS Extension
Here the untested snipplet
frontend ldaps_frontend
mode tcp
log global
bind *:636 ssl crt /etc/ssl/private/hap/
description LDAPS Service
option tcplog
option logasap
option socket-stats
option tcpka
timeout client 60s
acl host_j req.ssl_sni -i j.com
acl host_*** req.ssl_sni -i ***tech.com
use_backend j_ldaps if host_j
use_backend e*** if host_***