# Different SSL certificates over single IP

**URL:** <https://discourse.haproxy.org/t/different-ssl-certificates-over-single-ip/8752>\
**Category:** Help!\
**Created:** [June 10, 2023, 9:05pm UTC](https://discourse.haproxy.org/t/different-ssl-certificates-over-single-ip/8752 "2023-06-10T21:05:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aebian](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/aebian/32/1973_2.png) [@Aebian](https://discourse.haproxy.org/u/Aebian)\
**Post date:** [June 10, 2023, 9:05pm UTC](https://discourse.haproxy.org/t/different-ssl-certificates-over-single-ip/8752/1 "2023-06-10T21:05:07Z")

</div>

Hi,

I have a few services I like to serve with HaProxy over 443.  
The question is now with the TLS certificates. Normally I would issue individual certificates for each service. If I do this, I could have different frontends on different IPs listening on 443, but that seems impractical.

What I think I should do is the following: one TLS frontend (443) on a single IP without SSL termination, that based on SNI routes to other TLS frontends that do terminate SSL (listening on 127.0.0.1:443) and then those go back to the backend servers.

So kinda like this:

```auto
frontend master-tls
   bind 10.145.50.107:443
   mode tcp
   description Master-TLS
   option tcplog
   timeout client 3600s
   use_backend app01-tls { req.ssl_sni app01.company.net }
   use_backend app02-tls { req.ssl_sni app02.company.net }

frontend app01-tls
   bind 127.0.0.1:443 ssl crt /root/.vault/app01.company.net.pem ciphers ECDHE-RSA-AES256-SHA:-RC4-SHA:HIGH:!MD5:!aNULL:!EDH
   mode tcp
   description Application 1 (TLS)
   option tcplog
   
   default_backend app01-backend-http

frontend app02-tls
   bind 127.0.0.1:443 ssl crt /root/.vault/app02.company.net.pem ciphers ECDHE-RSA-AES256-SHA:-RC4-SHA:HIGH:!MD5:!aNULL:!EDH
   mode tcp
   description Application 2 (TLS)
   option tcplog

   default_backend app01-backend-http

backend app01-backend-http
   mode tcp 
   server app01-server-01 10.0.0.115:80

backend app02-backend-http
   mode tcp 
   server app01-server-01 10.0.0.116:80

```

Does this make sense and is this the correct approach?

---

<div class="post-metadata">

**Author:** ![simplexion](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/simplexion/32/1858_2.png) [@simplexion](https://discourse.haproxy.org/u/simplexion)\
**Post date:** [June 11, 2023, 3:33am UTC](https://discourse.haproxy.org/t/different-ssl-certificates-over-single-ip/8752/2 "2023-06-11T03:33:03Z")

</div>

I do this and have a write up about how I do it.

> **[My HAProxy Configuration](https://ciphermenial.github.io/posts/my-haproxy-config/)**
>
> This is an explanation of my HAProxy config, mostly as a reminder for myself. This has evolved over time. Most recently I have added a redirection for external or internal traffic to backends. The reason for this was due to adding a Jellyfin server...

---

<div class="post-metadata">

**Author:** ![Aebian](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/aebian/32/1973_2.png) [@Aebian](https://discourse.haproxy.org/u/Aebian)\
**Post date:** [June 11, 2023, 9:43am UTC](https://discourse.haproxy.org/t/different-ssl-certificates-over-single-ip/8752/3 "2023-06-11T09:43:17Z")

</div>

Thanks for the reply. It seems that you are using once certificate for all internal services? Is that correct?  
Ideally I would want for each services a different cert.

---

<div class="post-metadata">

**Author:** ![simplexion](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/simplexion/32/1858_2.png) [@simplexion](https://discourse.haproxy.org/u/simplexion)\
**Post date:** [June 12, 2023, 4:12pm UTC](https://discourse.haproxy.org/t/different-ssl-certificates-over-single-ip/8752/4 "2023-06-12T16:12:29Z")

</div>

> **[Multiple SSL Configurations in the Same IP/Port with HAProxy](https://medium.com/trabe/multiple-ssl-configurations-in-the-same-ip-port-with-haproxy-349c7dc9a170)**
>
> How we used some clever TCP routing to overcome the HAProxy limitations regarding SSL configuration.

---

<div class="post-metadata">

**Author:** ![Aebian](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/aebian/32/1973_2.png) [@Aebian](https://discourse.haproxy.org/u/Aebian)\
**Post date:** [June 14, 2023, 7:03pm UTC](https://discourse.haproxy.org/t/different-ssl-certificates-over-single-ip/8752/5 "2023-06-14T19:03:28Z")

</div>

Thanks, just had some time to test this and it works.  
Just leaving the important bits here for anyone else:

```auto
# Staging SSL Frontend
frontend Staging-SSL
  bind 10.145.50.108:443
  mode tcp
  tcp-request inspect-delay 5s
  tcp-request content accept if { req_ssl_hello_type 1 }
  use_backend proxyb-somename if { req_ssl_sni -i sub.domain.net }

# Staging Backends
backend proxyb-somename
    mode tcp
    server loopback-for-tls abns@company-had01 send-proxy-v2

# HTTPS - Frontend 01
frontend F01-SSL
  bind abns@nethavn-had01 accept-proxy ssl crt /root/.vault/sub.domain.net-1686501700.pem ciphers ECDHE-RSA-AES256-SHA:-RC4-SHA:HIGH:!MD5:!aNULL:!EDH
  mode http
  description Some Services
  option tcplog
  timeout client 3600s
  default_backend company-backend-01

  acl trusted_ip src 10.0.0.14 10.0.10.23
  http-request deny deny_status 403 if !trusted_ip

# Backend 01
backend company-backend-01
  mode http
  server b01server01 10.0.0.2:80

```

Adjust to your needs of course.