Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to serve several applications over https using one external ip address.

The ssl certificates should not be managed on the reverse proxy. They are installed on the application servers.

Can a reverse proxy be configured to use SNI and pass ssl through for termination at the endpoint?

Is this possible using something like Nginx or Apache? What does the configuration look like?

share|improve this question
up vote 9 down vote accepted

This IS possible with Haproxy. You can setup a TCP proxy and extract the SNI and do routing based on the SNI. Here's an example:

backend be.app1
    mode tcp
    no option checkcache
    no option httpclose
    tcp-request inspect-delay 5s
    tcp-request content accept if { req.ssl_hello_type 1 }
    tcp-request content reject
    use-server server1 if { req.ssl_sni -m beg app1. }
    server server1 server1:8443 check id 1 weight 0

It is essential to delay the request until you get the SSL hello, otherwise haproxy will try to make a connection before receiving the SNI header.

I am using servers with weight 0 because, in my current configuration, I only have one server running for each SNI and I don't want them to receive random requests. You can probably find better ways to play with this.

I hope this helps.

share|improve this answer
What version of haproxy supports this? – Michael Hampton Aug 31 '14 at 23:16
1.5+ does support it. I have this running in a production environment already. I will post a demo-config in a few mins. – Florin Asăvoaie Aug 31 '14 at 23:19
Aha! I haven't seen haproxy since 1.4, that explains it. – Michael Hampton Aug 31 '14 at 23:19
@user319862 I found this nice tutorial which seems to be what's being discussed. – Michael Hampton Aug 31 '14 at 23:21
Really? Why would someone downvote this answer? – Florin Asăvoaie Sep 1 '14 at 6:41

You can use sniproxy :

An example configuration :

listener {
    protocol tls
    table TableHTTPS

listener {
    protocol http
    table TableHTTP

table TableHTTPS { backend1:443 backend2:443

table TableHTTP { backend1:80 backend2:80
share|improve this answer
Thanks for posting about that project. I was not aware of it – user319862 Dec 7 '15 at 4:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.