3

I'm looking around trying to find an example of HAProxy matching SNI wildcards, and my searching is bringing up similarly titled, but unrelated questions about certificates.

Specifically I need to route nonce domains for dvsni with acme / letsencyrpt.

frontend foo_ft_https
    mode tcp
    option tcplog
    bind 0.0.0.0:443

    acl foo_app_letsencrypt req.ssl_sni -i *.acme.invalid
    use_backend foo_bk_letsencrypt if foo_app_letsencrypt

    default_backend foo_bk_default

backend foo_bk_letsencrypt
    mode tcp
    option tcplog

    server foo_srv_letsencrypt 127.0.0.1:3443

backend foo_bk_default
    mode tcp
    option tcplog

    server foo_srv_default 127.0.0.1:8443

Note: all arbitrary names are prefixed with 'foo_' so that the reader can easily distinguish them from keywords, directives and such.

coolaj86
  • 74,004
  • 20
  • 105
  • 125

2 Answers2

11

Change

acl foo_app_letsencrypt req.ssl_sni -i *.acme.invalid

to

acl foo_app_letsencrypt req.ssl_sni -m end .acme.invalid

It's not mentioned in the official documentation https://cbonte.github.io/haproxy-dconv/configuration-1.5.html explicitly, but I was able to find other resources that lead me to the correct result:

Note that if you were to try the first example, it would "work", but the "" would be interpreted as a literal "", not a wildcard.

coolaj86
  • 74,004
  • 20
  • 105
  • 125
  • Actually, you need "-m end acme.invalid", without the leading dot, otherwise https://acme.invalid doesn't work. You can just add both, -i acme.invalid and -m end .acme.invalid, and then it works reliably, with no wrong matches. But thanks anyway, that solved my problem ;) – Stefan Steiger Dec 10 '20 at 11:49
4

Even this is very old question, I would like to share this solution, because this is still among first google's results:

The solution given by CoolAJ86 doesn't work for me (it probably works for older version of HAProxy). You can instead use ssl_fc_sni_end instead of ssl_fc_sni like this:

use_backend apache if { ssl_fc_sni_end domain.com }

It will do the work!

patok
  • 181
  • 1
  • 9