If you are maintaining such haproxy ssl offloading, probably this quick'n'dirty script will be useful for you. !#/bin/sh openssl pkcs12 -in $1.pfx -out $1_nokey.pem -nokeys && \ openssl pkcs12 -in $1.pfx -out $1_withkey.pem && \ openssl rsa -in $1_

The solution was simple: Tell HAProxy to tag Websocket traffic, and set up a separate but otherwise identical backend for this specific use case. One of typical applications which is using Websocket traffic is Slack [https://slack.com/]. An excelent opensource  alternative of it named Mattermost [https://mattermost.com]. The