We have a lot of devices that cannot use SNI and we want to be able to proxy a lot of HTTP/HTTPS servers. I was thinking we could setup a HAProxy for each URL to connect to initially, and then load balance it off to a generic HAProxy server. Would this work? I mean, just use the front end servers to do the HTTP/HTTPS initial connection per URL and then pass the request off to a generic haproxy server?

  • 2
    I'm not quite sure you understand how SNI works. You need IP addresses, or at least a certificate with a lot of alternate names. No proxy is going to help you here. Of course, you should upgrade or decommission the misbehaving devices as soon as possible. – Michael Hampton Aug 26 '14 at 1:52
  • We have an IP address for each HAProxy server, as well as a certificate. We just want to be able to pass the connection off to a "generic" haproxy server after the device connects. – Mike Curry Aug 26 '14 at 14:10

Yes, although haproxy would almost be overkill for this. You could even bind an stunnel with the appropriate certificate to each IP address and make those connect to your central HAproxy.

There's not even need to have more than one HAproxy.

listen ssl-domain1
    bind public-ip-1:443
    # <- ssl config here ->
    server haproxy localhost:6000

listen ssl-domain2
    bind public-ip-2:443
    # <- ssl config here ->
    server haproxy localhost:6000

 ... # more ssl listeners

 frontend http-proxy
     bind localhost:6000
     acl application1 hdr_beg(host) -i domain1
     acl application1 hdr_beg(host) -i domain1.2
     acl application2 hdr_beg(host) -i domain2
     # ...
     use_backend application1 if application1
     # ...

Not especially pretty, but would get the job done, I believe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.