# ACLs with TLS and URL paths

**URL:** <https://discourse.haproxy.org/t/acls-with-tls-and-url-paths/7498>\
**Category:** Help!\
**Created:** [March 15, 2022, 2:19pm UTC](https://discourse.haproxy.org/t/acls-with-tls-and-url-paths/7498 "2022-03-15T14:19:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mac](https://avatars.discourse-cdn.com/v4/letter/m/cc9497/32.png) [@Mac](https://discourse.haproxy.org/u/Mac)\
**Post date:** [March 15, 2022, 2:19pm UTC](https://discourse.haproxy.org/t/acls-with-tls-and-url-paths/7498/1 "2022-03-15T14:19:39Z")

</div>

Hello Everyone,

I have an application that requires client certificate authentication. These applications run on different ports and are accessed by path. [https://host.domain.com:9443/application1](https://host.domain.com:9443/application1), [https://host.domain.com:9444/application2](https://host.domain.com:9444/application2).

I would like to ‘hide’ those ports or redirect to the backend for each of those separate application.

Do I terminate the TLS at the HAProxy, use an ACL to determine the correct backend server - than pass the client certificate as a header?

Is that the correct approach?

---

<div class="post-metadata">

**Author:** ![Mac](https://avatars.discourse-cdn.com/v4/letter/m/cc9497/32.png) [@Mac](https://discourse.haproxy.org/u/Mac)\
**Post date:** [March 20, 2022, 8:17pm UTC](https://discourse.haproxy.org/t/acls-with-tls-and-url-paths/7498/2 "2022-03-20T20:17:36Z")

</div>

Further follow-up to my question. Attached is my config.  
So I do certificate authentication to HAProxy and terminate so that I can examine the URL Path.  
If it is just a host.domain than pass that through a a Web Site.

If the host.domain includes a path than redirect to that specific application port.

frontend web-in  
bind \*:443 ssl verify required crt /etc/haproxy/cert/cert.pem ca-file /etc/haproxy/cert/cacert.pem  
mode http

```
http-request set-header SSL_CLIENT_CERT &[ssl_c_der.base64]
http-request set-header X-Real-IP %[src]

acl user_app1 path -i -m beg /Application/

use_backend web if { req.hdr(host) -i host.domain.com }
use_backend app1 if user_app1

default_backend web

```

backend web  
server web1 192.1.1.121:443 ssl verify none

backend app1  
server app\_srv1 192.1.2.121:9443 ssl verify none