0

I have several backend web servers that have multiple vhosts and I want to use HAProxy in front of them. It doesn't appear that HAProxy is sending the hostname in the TLS connection to the backend servers.

Here is an example of the backend configuration:

backend app_cluster
  balance     roundrobin
  server app1 host1.com:443 ssl no-sslv3
  server app2 host2.com:443 ssl no-sslv3

Is it possible to configure HAProxy to work with backend web servers that require SNI?

Brandon
  • 53
  • 1
  • 8
  • Are you trying to get HAProxy to decrypt and re-encrypt the traffic with one SSL connection from client to HAProxy and another from HAProxy to backend? Or are you trying to get HAProxy to pass SSL connections from clients to the backends such that you have end-to-end encryption, and HAProxy doesn't need to hold the key? – kasperd Mar 24 '15 at 22:16
  • 1
    Sorry, yes I am terminating this connection at HAProxy, however, some of the backend servers require SSL so HAProxy is re-encrypting the connection to the backend. – Brandon Mar 24 '15 at 22:17
  • I don't know how to achieve that. To me it seems unusual to have the backends require SNI. I would rather have expected a setup in which proxy required SNI and the backend did not. Maybe somebody else can come up with an answer to your question. – kasperd Mar 24 '15 at 22:21

0 Answers0