If you are maintaining such haproxy ssl offloading, probably this quick'n'dirty script will be useful for you. !#/bin/sh openssl pkcs12 -in $1.pfx -out $1_nokey.pem -nokeys && \ openssl pkcs12 -in $1.pfx -out $1_withkey.pem && \ openssl rsa -in $1_

The solution was simple: Tell HAProxy to tag Websocket traffic, and set up a separate but otherwise identical backend for this specific use case. One of typical applications which is using Websocket traffic is Slack. An excelent opensource alternative of it named Mattermost. The result looks something like this in