# Configuration does not work when tested with openssl without servername

**URL:** <https://discourse.haproxy.org/t/configuration-does-not-work-when-tested-with-openssl-without-servername/2513>\
**Category:** Help!\
**Created:** [May 20, 2018, 10:53pm UTC](https://discourse.haproxy.org/t/configuration-does-not-work-when-tested-with-openssl-without-servername/2513 "2018-05-20T22:53:13Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![augustynr](https://avatars.discourse-cdn.com/v4/letter/a/4af34b/32.png) [@augustynr](https://discourse.haproxy.org/u/augustynr)\
**Post date:** [May 20, 2018, 10:53pm UTC](https://discourse.haproxy.org/t/configuration-does-not-work-when-tested-with-openssl-without-servername/2513/1 "2018-05-20T22:53:13Z")

</div>

Hi,  
I have haproxy running ok for most part, though I have one service which uses ssl and I have problems with it.  
When I test it as:  
openssl s\_client -connect [node1.server.com:443](http://node1.server.com:443) -servername [node1.server.com](http://node1.server.com)  
haproxy redirects correctly returns correct certificate  
if tested as  
openssl s\_client -connect [node1.server.com:443](http://node1.server.com:443)  
it does not redirect.  
Any idea how to fix it?

frontend z-https-in  
bind \*:443

```
    mode tcp
    tcp-request inspect-delay 5s
    tcp-request content accept if { req.ssl_hello_type 1 }

    use_backend z-zc_01_https_backend if { req.ssl_sni -i node1.server.com }
    use_backend z-zc_02_https_backend if { req.ssl_sni -i node2.server.com }

```

backend z-zc\_02\_https\_backend  
mode tcp  
server node11 192.168.199.229:443

backend z-zc\_01\_https\_backend  
mode tcp  
server node4 192.168.199.132:443

---

<div class="post-metadata">

**Author:** ![shivharsh](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/shivharsh/32/388_2.png) [@shivharsh](https://discourse.haproxy.org/u/shivharsh)\
**Post date:** [May 21, 2018, 5:49am UTC](https://discourse.haproxy.org/t/configuration-does-not-work-when-tested-with-openssl-without-servername/2513/2 "2018-05-21T05:49:33Z")

</div>

Hi augustynr,

Your HAProxy configuration appears perfectly fine to me. The reason your request is not getting redirected when not using the **servername** option is because you are not passing an SNI as a part of SSL/TLS handshake.  
To provide you some context, SNI allows a server to have multiple SSL certificates installed on the same IP address. In that scenario, if you are not providing the hostname of the server during the handshake process, the server wouldn’t know the correct SSL certificate to use for the connection and would instead use the default certificate.

This is exactly what seems to be happening in your case.

> [@augustynr](#):
>
> openssl s\_client -connect [node1.server.com:443](http://node1.server.com:443) -servername [node1.server.com](http://node1.server.com)

When you use the above command, an SSL handshake is performed to establish a secure connection on [node1.server.com](http://node1.server.com) port 443 and the certificate for [node1.server.com](http://node1.server.com) , as specified by servername option, is used.

> [@augustynr](#):
>
> openssl s\_client -connect [node1.server.com:443](http://node1.server.com:443)

When you use the above command, an SSL handshake is performed to establish secure connection on [node1.server.com](http://node1.server.com) port 443. But here the default SSL certificate is used as there is is no SNI specified by servername.  
This is why the **req.ssl\_sni** directive is unable to retrieve the hostname based on which the redirection has to be performed and thus the acl “`req.ssl_sni -i node1.server.com`” returns false.

As a solution, i would recommend you to incorporate the use of servername option in the service using the SSL rather than going for a complex HAProxy configuration.

Hope this is helpful !

Thanks  
Shivharsh

---

<div class="post-metadata">

**Author:** ![augustynr](https://avatars.discourse-cdn.com/v4/letter/a/4af34b/32.png) [@augustynr](https://discourse.haproxy.org/u/augustynr)\
**Post date:** [May 21, 2018, 1:54pm UTC](https://discourse.haproxy.org/t/configuration-does-not-work-when-tested-with-openssl-without-servername/2513/3 "2018-05-21T13:54:25Z")

</div>

Shivharsh  
Thank you.  
I do not have a control of the clients connecting to this service so I am not sure how would I incorporate servername option? Any pointers?  
Since that does not seem like a possibility any pointers on how to setup HAProxy to deal with it?  
Thank you very much.  
robert

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 21, 2018, 11:04pm UTC](https://discourse.haproxy.org/t/configuration-does-not-work-when-tested-with-openssl-without-servername/2513/4 "2018-05-21T23:04:23Z")

</div>

Every supported browser on every supported Operating System sends SNI for HTTPS. If you need to support IE6 on Windows XP use cases, then you need to have a dedicated public IP address for each routing decision that you want to take.

---

<div class="post-metadata">

**Author:** ![ghp](https://avatars.discourse-cdn.com/v4/letter/g/ee59a6/32.png) [@ghp](https://discourse.haproxy.org/u/ghp)\
**Post date:** [May 27, 2018, 1:52pm UTC](https://discourse.haproxy.org/t/configuration-does-not-work-when-tested-with-openssl-without-servername/2513/5 "2018-05-27T13:52:25Z")

</div>

Just host your domains on different IP’s, to which HAProxy can bind.

---

<div class="post-metadata">

**Author:** ![augustynr](https://avatars.discourse-cdn.com/v4/letter/a/4af34b/32.png) [@augustynr](https://discourse.haproxy.org/u/augustynr)\
**Post date:** [May 27, 2018, 3:18pm UTC](https://discourse.haproxy.org/t/configuration-does-not-work-when-tested-with-openssl-without-servername/2513/6 "2018-05-27T15:18:58Z")

</div>

Can these IPs be internal (192.168.1.x)? If so how would I do the binding?  
Thanks a lot.

---

<div class="post-metadata">

**Author:** ![ghp](https://avatars.discourse-cdn.com/v4/letter/g/ee59a6/32.png) [@ghp](https://discourse.haproxy.org/u/ghp)\
**Post date:** [May 27, 2018, 4:02pm UTC](https://discourse.haproxy.org/t/configuration-does-not-work-when-tested-with-openssl-without-servername/2513/7 "2018-05-27T16:02:31Z")

</div>

If you have external users, they have to be public IP’s.