Different SSL Protocols for each backend server. Is it possible?

[lukastribus]

I assume you understand that you are actually disabling TLSv1.0 with this configuration, not SSLv3.

@reinaldo.gomes

server apache 10.0.0.1 no-tlsv10 <- doesn’t work
ssl-default-server-options no-tlsv10 <- doesn’t work

This 2 options disable TLSv1.0 on SSL connections from haproxy to the backend server (if any). It has nothing todo with the SSL session between the browser and haproxy however.

@reinaldo.gomes

Is there any way to disable a given SSL protocol for specific backend servers, other than using different IPs/frontends?

No, it isn’t, you need dedicated bind statements.

If all you have is a single IP address and port and you absolutely need this: use a TCP frontend without SSL termination, SNI route to different backends that recirculate to traffic to dedicated SSL frontends with different configurations:

How to set ssl verify client for specific domain name

There is no simple way to do this, unfortunately. Use a TCP frontend withouth SSL termination, SNI route to different backends that recirculate to traffic to dedicated SSL frontends with different configurations. Something like: frontend port443 bind :443 tcp-request inspect-delay 5s tcp-request content accept if { req_ssl_hello_type 1 } use_backend recir_clientcertenabled if { req_ssl_sni -i test1.demo.com } default_backend recir_default backend recir_clientcertenabled …