# Different SSL Protocols for each backend server. Is it possible?
**URL:** https://discourse.haproxy.org/t/different-ssl-protocols-for-each-backend-server-is-it-possible/1905
**Category:** Help!
**Created:** [December 14, 2017, 1:02pm UTC](https://discourse.haproxy.org/t/different-ssl-protocols-for-each-backend-server-is-it-possible/1905 "2017-12-14T13:02:21Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@reinaldo.gomes](https://discourse.haproxy.org/u/reinaldo.gomes)
#### Post date: [December 14, 2017, 1:02pm UTC](https://discourse.haproxy.org/t/different-ssl-protocols-for-each-backend-server-is-it-possible/1905/1 "2017-12-14T13:02:21Z")
I need to disable TLSv1.0for one of my webservers, but not for the rest of them.
bind :443 ssl crt /etc/haproxy/merged.pem no-tlsv10 **\<- works**
ssl-default-bind-options no-tlsv10 **\<- works**
server apache 10.0.0.1 no-tlsv10 **\<- doesn’t work**
ssl-default-server-options no-tlsv10 **\<- doesn’t work**
Is there any way to disable a given SSL protocol for specific backend servers, other than using different IPs/frontends?
---
### Author:  [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [December 14, 2017, 2:32pm UTC](https://discourse.haproxy.org/t/different-ssl-protocols-for-each-backend-server-is-it-possible/1905/2 "2017-12-14T14:32:19Z")
I assume you understand that you are actually disabling TLSv1.0 with this configuration, not SSLv3.
> [@reinaldo.gomes](#):
>
> server apache 10.0.0.1 no-tlsv10 \<- doesn’t work
> ssl-default-server-options no-tlsv10 \<- doesn’t work
This 2 options disable TLSv1.0 on SSL connections from haproxy to the backend server (if any). It has nothing todo with the SSL session between the browser and haproxy however.
> [@reinaldo.gomes](#):
>
> Is there any way to disable a given SSL protocol for specific backend servers, other than using different IPs/frontends?
No, it isn’t, you need dedicated bind statements.
If all you have is a single IP address and port and you absolutely need this: use a TCP frontend without SSL termination, SNI route to different backends that recirculate to traffic to dedicated SSL frontends with different configurations:
> [@How to set ssl verify client for specific domain name](https://discourse.haproxy.org/t/how-to-set-ssl-verify-client-for-specific-domain-name/1489/3):
>
> There is no simple way to do this, unfortunately. Use a TCP frontend withouth SSL termination, SNI route to different backends that recirculate to traffic to dedicated SSL frontends with different configurations. Something like: frontend port443 bind :443 tcp-request inspect-delay 5s tcp-request content accept if { req\_ssl\_hello\_type 1 } use\_backend recir\_clientcertenabled if { req\_ssl\_sni -i test1.demo.com } default\_backend recir\_default backend recir\_clientcertenabled …
---
### Author:  [@reinaldo.gomes](https://discourse.haproxy.org/u/reinaldo.gomes)
#### Post date: [December 14, 2017, 3:21pm UTC](https://discourse.haproxy.org/t/different-ssl-protocols-for-each-backend-server-is-it-possible/1905/3 "2017-12-14T15:21:52Z")
Yes, I meant TLS1.0 when I said SSLv3.
I see. So the only way is by having separated bind statements. The TCP frontend could make me save one public IP address, though.
Thanks anyway.