I have a working haproxy setup that is doing TLS termination for multiple tenant domains.
Today I added a wildcard cert (call it *.foo.com) to my cert pool. haproxy is properly picking this cert when a browser goes to https://fnord.foo.com.
However, for whatever dumb reason, this user wants their primary domain to be https://www.fnord.foo.com. When the wildcard cert is installed directly in IIS, with a dedicated IP binding, and the URL is attempted bypassing haproxy, this works, even though I don't think it should according to the strict definition of SSL processing (see this answer ). Nevertheless, browsers accept a prefixed www, even if they shouldn't, and to make this client happy, we'd like it to happen anyway. Is there any way to tell haproxy to use that specific cert when the incoming domain is www.fnord.foo.com?