curl -vvk

$ curl -vvk https://echo-5ooike70s.now.sh | pbcopy 
* Rebuilt URL to: https://echo-5ooike70s.now.sh/
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 54.250.49.38...
* TCP_NODELAY set
* Connected to echo-5ooike70s.now.sh (54.250.49.38) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [227 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [102 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [2551 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [333 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [70 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
{ [1 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=*.now.sh
*  start date: Feb 28 19:45:55 2019 GMT
*  expire date: May 29 19:45:55 2019 GMT
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x7fd294804400)
> GET / HTTP/2
> Host: echo-5ooike70s.now.sh
> User-Agent: curl/7.54.0
> Accept: */*
> 
* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
< HTTP/2 200 
< date: Wed, 03 Apr 2019 04:38:21 GMT
< content-type: application/json; charset=utf-8
< content-length: 642
< cache-control: s-maxage=0
< x-now-trace: hnd1
< server: now
< now: 1
< x-now-id: r8ftm-1554266301134-bbe133323fafd9cb7db4c169479df5be
< x-now-cache: MISS
< accept-ranges: bytes
< 
{ [642 bytes data]
100   642  100   642    0     0   2468      0 --:--:-- --:--:-- --:--:--  2469
* Connection #0 to host echo-5ooike70s.now.sh left intact
(hden@TARDIS :eks-static-ip) $ clear

(hden@TARDIS :eks-static-ip) $ curl -vvk https://echo-5ooike70s.now.sh
* Rebuilt URL to: https://echo-5ooike70s.now.sh/
*   Trying 54.250.49.38...
* TCP_NODELAY set
* Connected to echo-5ooike70s.now.sh (54.250.49.38) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=*.now.sh
*  start date: Feb 28 19:45:55 2019 GMT
*  expire date: May 29 19:45:55 2019 GMT
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x7fe43e00d600)
> GET / HTTP/2
> Host: echo-5ooike70s.now.sh
> User-Agent: curl/7.54.0
> Accept: */*
> 
* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
< HTTP/2 200 
< date: Wed, 03 Apr 2019 04:38:26 GMT
< content-type: application/json; charset=utf-8
< content-length: 642
< cache-control: s-maxage=0
< x-now-trace: hnd1
< server: now
< now: 1
< x-now-id: r8ftm-1554266306840-8da724b921c8341fe8c7932915d149d9
< x-now-cache: MISS
< accept-ranges: bytes
< 
* Connection #0 to host echo-5ooike70s.now.sh left intact
{"url":{"protocol":null,"slashes":null,"auth":null,"host":null,"port":null,"hostname":null,"hash":null,"search":"","query":{},"pathname":"/","path":"/","href":"/"},"headers":{"x-forwarded-host":"echo-5ooike70s.now.sh","x-forwarded-for":"122.220.122.10","x-now-trace":"hnd1","connection":"close","accept":"*/*","x-real-ip":"122.220.122.10","user-agent":"curl/7.54.0","host":"echo-5ooike70s.now.sh","x-now-log-id":"8da724b921c8341fe8c7932915d149d9","x-forwarded-proto":"https","x-zeit-co-forwarded-for":"122.220.122.10","x-now-id":"r8ftm-1554266306840-8da724b921c8341fe8c7932915d149d9","x-now-deployment-url":"echo-5ooike70s.now.sh"},"body":""}

haproxy.cfg

defaults
  retries 3
  maxconn 3000
  timeout connect 5s
  timeout server 10s
  timeout client 10s

frontend frontend_http
  bind *:8000
  mode http
  reqadd X-Forwarded-Proto:\ http
  default_backend backend_https

backend backend_https
  mode http
  server remote echo-5ooike70s.now.sh:443 check ssl verify none