Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to serve several applications over https using one external ip address.

The ssl certificates should not be managed on the reverse proxy. They are installed on the application servers.

Can a reverse proxy be configured to use SNI and pass ssl through for termination at the endpoint?

Is this possible using something like Nginx or Apache? What does the configuration look like?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

This IS possible with Haproxy. You can setup a TCP proxy and extract the SNI and do routing based on the SNI. Here's an example:

backend be.app1
    mode tcp
    no option checkcache
    no option httpclose
    tcp-request inspect-delay 5s
    tcp-request content accept if { req.ssl_hello_type 1 }
    tcp-request content reject
    use-server server1 if { req.ssl_sni -m beg app1. }
    server server1 server1:8443 check id 1 weight 0

It is essential to delay the request until you get the SSL hello, otherwise haproxy will try to make a connection before receiving the SNI header.

I am using servers with weight 0 because, in my current configuration, I only have one server running for each SNI and I don't want them to receive random requests. You can probably find better ways to play with this.

I hope this helps.

share|improve this answer
1  
What version of haproxy supports this? –  Michael Hampton Aug 31 at 23:16
    
Can you point me towards any documentation of this or a configuration snippet so I can accept the answer? –  user319862 Aug 31 at 23:17
2  
1.5+ does support it. I have this running in a production environment already. I will post a demo-config in a few mins. –  Florin Asavoaie Aug 31 at 23:19
1  
Aha! I haven't seen haproxy since 1.4, that explains it. –  Michael Hampton Aug 31 at 23:19
3  
@user319862 I found this nice tutorial which seems to be what's being discussed. –  Michael Hampton Aug 31 at 23:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.