This issue is similar to #873

Actual behaviour:

When orchestrator.conf.json is configured that way:

{
  "HTTPAdvertise": "http://{{ orchestrator_hostname }}:{{ orchestrator_port }}",
  "UseSSL": false
}

Then reverse-proxy works fine and curl - D - http://{orchestrator_ip}:{orchestrator_port}/api/clusters request returns correct information about known clusters both for a raft leader and its followers.

But when it is configured that way:

{
  "HTTPAdvertise": "https://{{ orchestrator_hostname }}:{{ orchestrator_port }}",
  "UseSSL": true
}

Then curl -D - -k https://{orchestrator_ip}:{orchestrator_port}/api/clusters request returns correct information only if it was sent to a raft leader. If it's sent to a follower, it returns 502 Bad Gateway and Orchestrator logs say: remote error: tls: bad certificate.

Expected behaviour:

reverse-proxy should work properly, so any follower should be able to provide requested information from its leader.

Root cause analysis:

   func (p *ReverseProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
   	transport := p.Transport
    	if transport == nil {
    		transport = http.DefaultTransport
    	}

This works when SSL is disabled, but it breaks routing logic in the middle when it is enabled.

Workaround:

Sending all requests directly to a raft leader works pretty well both with and without SSL.

Solution proposal:

A suitable HTTP transport is already being created for raft health requests: