title: Azure traffic manager shows Online for TCP/443 probe but Degraded for HTTPS /443 probe
body: <p>I have an Azure Traffic Manager set up to monitor some HTTPS services exposed on via public IP addresses.</p>
  
  <p>When I set the health probe to be TCP / 443, the probe works fine and the endpoint shows Online.</p>
  
  <p>When I set the HTTPS probe on port 443 to /images/favicon.ico, with appropriate host: and user-agent: headers which I have confirmed work with curl-k via command line, and even set allowed HTTP return codes to 100-599, the probe still shows Degraded.</p>
  
  <p>I am wondering if this is because we use a highly secure (A+ rating on qualys SSL checker) SSL cipher suite and only permit TLS 1.2+, and there is an SSL handshake failure by the azure traffic manager monitors?</p>
  
  <p>Is there any way to verify this? </p>
  
  <p>The ciphers our website allows are:</p>
  
  <ul>
  <li>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH x25519 (eq.
  3072 bits RSA)   FS</li>
  <li>TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)   ECDH x25519 (eq.
  3072 bits RSA)   FS</li>
  </ul>
  
  <p>And again, we only permit TLS 1.2.</p>
  
  <p><strong>Edit:</strong> Our server serves an SNI certificate. Supposedly these are 'not supported', not just 'not validated'. Is this what's breaking the HTTPS health probes?</p>
  
  <p><a href="https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-faqs#can-i-monitor-https-endpoints" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-faqs#can-i-monitor-https-endpoints</a></p>