Merge ~hloeung/content-cache-charm:http2 into content-cache-charm:master

[Haw Loeung]

Fixed use of ALPN - no h2 for HTTP checks; ALPN to backends only HAProxy 2

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Thomas Cuthbert (tcuthbert)]

LGTM +1. It might be an idea to improve the way we build the tls_config lines so it's easier to adjust backend parameters.

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 6dd9d7fa3f3613f6d3c3cbe05d2d8662a7849ad2

diff --git a/lib/haproxy.py b/lib/haproxy.py
index caade63..9f7691c 100644
--- a/lib/haproxy.py
+++ b/lib/haproxy.py
@@ -242,12 +242,13 @@ backend backend-{name}
                 if loc_conf.get('backend-tls'):
                     tls_config = (
                         ' ssl sni str({site_name}) check-sni {site_name} verify required'
-                        ' ca-file ca-certificates.crt alpn h2,http/1.1'.format(site_name=site_name)
+                        ' ca-file ca-certificates.crt'.format(site_name=site_name)
                     )
                     ver = utils.package_version('haproxy')
-                    # With HAProxy 2, we also need check-alpn
+                    # With HAProxy 2 and above, ALPN to backends is supported.
                     if LooseVersion(ver) >= LooseVersion('2'):
-                        tls_config += ' check-alpn h2,http/1.1'
+                        # The checks are using HTTP/1.1 so we only want http/1.1 here, rather than h2.
+                        tls_config += ' alpn h2,http/1.1 check-alpn http/1.1'
                 inter_time = loc_conf.get('backend-inter-time', '5s')
                 fall_count = loc_conf.get('backend-fall-count', 5)
                 rise_count = loc_conf.get('backend-rise-count', 2)
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
index 0b8e1d1..a37a6c8 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
@@ -189,9 +189,9 @@ backend backend-site2-local
     http-request set-header Host site2.local
     option redispatch 1
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
 
 backend backend-cached-site3-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site3.local\r\nUser-Agent:\ haproxy/httpchk
@@ -251,7 +251,7 @@ backend backend-site6-local
     http-request set-header Host site6.local
     option redispatch 1
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt
 
 backend backend-cached-site7-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk
@@ -286,7 +286,7 @@ backend backend-site8-local-2
     http-request set-header Host auth.site8.local
     option redispatch 1
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt
 
 backend backend-cached-site9-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site9.local\r\nUser-Agent:\ haproxy/httpchk
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
index a700412..ed69e91 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
@@ -189,9 +189,9 @@ backend backend-site2-local
     http-request set-header Host site2.local
     option redispatch 1
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
 
 backend backend-cached-site3-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site3.local\r\nUser-Agent:\ haproxy/httpchk
@@ -251,7 +251,7 @@ backend backend-site6-local
     http-request set-header Host site6.local
     option redispatch 1
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt
 
 backend backend-cached-site7-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk
@@ -286,7 +286,7 @@ backend backend-site8-local-2
     http-request set-header Host auth.site8.local
     option redispatch 1
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt
 
 backend backend-cached-site9-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site9.local\r\nUser-Agent:\ haproxy/httpchk
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_load_balancing_algorithm.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_load_balancing_algorithm.txt
index 215beb5..b1e58f1 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output_load_balancing_algorithm.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_load_balancing_algorithm.txt
@@ -189,9 +189,9 @@ backend backend-site2-local
     http-request set-header Host site2.local
     option redispatch 1
     balance roundrobin
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
 
 backend backend-cached-site3-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site3.local\r\nUser-Agent:\ haproxy/httpchk
@@ -251,7 +251,7 @@ backend backend-site6-local
     http-request set-header Host site6.local
     option redispatch 1
     balance roundrobin
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt
 
 backend backend-cached-site7-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk
@@ -286,7 +286,7 @@ backend backend-site8-local-2
     http-request set-header Host auth.site8.local
     option redispatch 1
     balance roundrobin
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt
 
 backend backend-cached-site9-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site9.local\r\nUser-Agent:\ haproxy/httpchk
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads.txt
index b9ee1fa..bb18c43 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads.txt
@@ -190,9 +190,9 @@ backend backend-site2-local
     http-request set-header Host site2.local
     option redispatch 1
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
 
 backend backend-cached-site3-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site3.local\r\nUser-Agent:\ haproxy/httpchk
@@ -252,7 +252,7 @@ backend backend-site6-local
     http-request set-header Host site6.local
     option redispatch 1
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt
 
 backend backend-cached-site7-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk
@@ -287,7 +287,7 @@ backend backend-site8-local-2
     http-request set-header Host auth.site8.local
     option redispatch 1
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt
 
 backend backend-cached-site9-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site9.local\r\nUser-Agent:\ haproxy/httpchk
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads_haproxy2.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads_haproxy2.txt
index 0b8934b..a788d15 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads_haproxy2.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads_haproxy2.txt
@@ -191,9 +191,9 @@ backend backend-site2-local
     retry-on all-retryable-errors
     option redispatch 1
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn h2,http/1.1
-    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn h2,http/1.1
-    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn http/1.1
+    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn http/1.1
+    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn http/1.1
 
 backend backend-cached-site3-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site3.local\r\nUser-Agent:\ haproxy/httpchk
@@ -257,7 +257,7 @@ backend backend-site6-local
     retry-on all-retryable-errors
     option redispatch 1
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn http/1.1
 
 backend backend-cached-site7-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk
@@ -295,7 +295,7 @@ backend backend-site8-local-2
     retry-on all-retryable-errors
     option redispatch 1
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn http/1.1
 
 backend backend-cached-site9-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site9.local\r\nUser-Agent:\ haproxy/httpchk
diff --git a/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output.txt b/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output.txt
index b3eab8c..ed6d54b 100644
--- a/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output.txt
+++ b/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output.txt
@@ -11,9 +11,9 @@ backend backend-site2-local
     option httpchk GET /check/ HTTP/1.1\r\nHost:\ site2.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site2.local
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
 
 backend backend-site3-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site3.local\r\nUser-Agent:\ haproxy/httpchk
@@ -41,7 +41,7 @@ backend backend-site6-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site6.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site6.local
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt
 
 backend backend-site7-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk
@@ -59,7 +59,7 @@ backend backend-site8-local-2
     option httpchk HEAD / HTTP/1.1\r\nHost:\ auth.site8.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host auth.site8.local
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt
 
 backend backend-site9-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site9.local\r\nUser-Agent:\ haproxy/httpchk
diff --git a/tests/unit/files/haproxy_config_rendered_test_output.txt b/tests/unit/files/haproxy_config_rendered_test_output.txt
index 9cf899e..3d927ab 100644
--- a/tests/unit/files/haproxy_config_rendered_test_output.txt
+++ b/tests/unit/files/haproxy_config_rendered_test_output.txt
@@ -119,9 +119,9 @@ backend backend-site2-local
     option httpchk GET /check/ HTTP/1.1\r\nHost:\ site2.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site2.local
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
 
 backend backend-site3-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site3.local\r\nUser-Agent:\ haproxy/httpchk
@@ -149,7 +149,7 @@ backend backend-site6-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site6.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site6.local
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt
 
 backend backend-site7-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk
@@ -167,7 +167,7 @@ backend backend-site8-local-2
     option httpchk HEAD / HTTP/1.1\r\nHost:\ auth.site8.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host auth.site8.local
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt
 
 backend backend-site9-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site9.local\r\nUser-Agent:\ haproxy/httpchk
diff --git a/tests/unit/files/haproxy_config_rendered_test_output2.txt b/tests/unit/files/haproxy_config_rendered_test_output2.txt
index 7aa5a43..04db8e4 100644
--- a/tests/unit/files/haproxy_config_rendered_test_output2.txt
+++ b/tests/unit/files/haproxy_config_rendered_test_output2.txt
@@ -119,9 +119,9 @@ backend backend-site2-local
     option httpchk GET /check/ HTTP/1.1\r\nHost:\ site2.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site2.local
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
-    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_2 127.0.1.11:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_3 127.0.1.12:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
 
 backend backend-site3-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site3.local\r\nUser-Agent:\ haproxy/httpchk
@@ -149,7 +149,7 @@ backend backend-site6-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site6.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site6.local
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt
 
 backend backend-site7-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk
@@ -167,7 +167,7 @@ backend backend-site8-local-2
     option httpchk HEAD / HTTP/1.1\r\nHost:\ auth.site8.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host auth.site8.local
     balance leastconn
-    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt alpn h2,http/1.1
+    server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt
 
 backend backend-site9-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site9.local\r\nUser-Agent:\ haproxy/httpchk