# HAProxy 1.6, Backend SNI not working in my implementation **URL:** \ **Category:** Help!\ **Created:** [June 11, 2016, 8:23am UTC](https://discourse.haproxy.org/t/haproxy-1-6-backend-sni-not-working-in-my-implementation/435 "2016-06-11T08:23:34Z")\ **Posts on this page:** 3\ **Page:** 1

**Author:** ![liam\_n](https://avatars.discourse-cdn.com/v4/letter/l/e68b1a/32.png) [@liam\_n](https://discourse.haproxy.org/u/liam_n)\ **Post date:** [June 11, 2016, 8:23am UTC](https://discourse.haproxy.org/t/haproxy-1-6-backend-sni-not-working-in-my-implementation/435/1 "2016-06-11T08:23:34Z")

Hi, So this is my first major solo HAProxy implementation, I was running HAProxy 1.5 on Red Hat 7 until one of our clients came forward with a requirement to use SNI on one of our backend resources. I’ve deployed 1.6 and an SNI backend resource and can’t seem to get a successful TLS exchange working, I’ve been watching the exchange with tcpdump and my client hello requests don’t seem to include a server name indicator field. The rest of the TLS exchange appears normal. I’ve tested the same connection/certs with an openssl test and find them successful and can verify the SNI field being submitted At this point I’m willing to try anything, I’ve spend about 48 hours working on this issue, and the large company I work for will be glaring at me pretty soon. Any suggestions, pointers will be greatly appreciated. Thanks, Liam # This file managed by Puppet global chroot /var/lib/haproxy daemon group haproxy log 127.0.0.1 local0 maxconn 4000 pidfile /var/run/haproxy.pid stats socket /var/lib/haproxy/stats user haproxy defaults log global maxconn 3000 mode http option httplog option forwardfor option http-server-close option redispatch retries 3 timeout http-request 10s timeout queue 1m timeout connect 10s timeout client 1m timeout server 1m timeout http-keep-alive 10s timeout check 10s frontend client\_farm-frontend bind 0.0.0.0:443 ssl crt /etc/ssl/certs/haproxy/server.crt mode http default\_backend client\_farm-backend option tcplog backend client\_farm-backend balance roundrobin mode http cookie JSESSIONID prefix nocache server client\_farm01 [client.com:443](http://client.com:443) cookie client\_farm01 check ssl sni str([client.com](http://client.com)) verify none crt /etc/ssl/certs/haproxy/client.crt Build Options: [root@int-prd-prx01-wm haproxy]# haproxy -vv HA-Proxy version 1.6.5 2016/05/10 Copyright 2000-2016 Willy Tarreau [willy@haproxy.org](mailto:willy@haproxy.org) Build options : TARGET = linux2628 CPU = generic CC = gcc CFLAGS = -O2 -g -fno-strict-aliasing -Wdeclaration-after-statement -DTCP\_USER\_TIMEOUT=18 OPTIONS = USE\_LINUX\_TPROXY=1 USE\_ZLIB=1 USE\_REGPARM=1 USE\_OPENSSL=1 USE\_PCRE=1 Default settings : maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200 Encrypted password support via crypt(3): yes Built with zlib version : 1.2.7 Compression algorithms supported : identity(“identity”), deflate(“deflate”), raw-deflate(“deflate”), gzip(“gzip”) Built with OpenSSL version : OpenSSL 1.0.1e-fips 11 Feb 2013 Running on OpenSSL version : OpenSSL 1.0.1e-fips 11 Feb 2013 OpenSSL library supports TLS extensions : yes OpenSSL library supports SNI : yes OpenSSL library supports prefer-server-ciphers : yes Built with PCRE version : 8.32 2012-11-30 PCRE library supports JIT : no (USE\_PCRE\_JIT not set) Built without Lua support Built with transparent proxy support using: IP\_TRANSPARENT IPV6\_TRANSPARENT IP\_FREEBIND Available polling systems : epoll : pref=300, test result OK poll : pref=200, test result OK select : pref=150, test result OK Total: 3 (3 usable), will use epoll. ---

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\ **Post date:** [June 12, 2016, 5:15am UTC](https://discourse.haproxy.org/t/haproxy-1-6-backend-sni-not-working-in-my-implementation/435/2 "2016-06-12T05:15:49Z")

The health check is the problem. The health check does not send the SNI header, while regular traffic would correctly handle it (disable health checking or revert to layer 4 health check would work around this problem). Also see: > [@Can 1.6 do SNI on backend?](http://discourse.haproxy.org/t/can-1-6-do-sni-on-backend/278/11): > > This works (SNI is set to [private.auricsystems.com](http://private.auricsystems.com) and the returned certificate is validated against the hostname [private.auricsystems.com](http://private.auricsystems.com)): server test private.auricsystems.com:443 ssl sni str(private.auricsystems.com) verifyhost private.auricsystems.com ca-file \ Haproxy refuses to connect if the hostname is something else: server test private.auricsystems.com:443 ssl sni str(private.auricsystems.com) verifyhost mail.com ca-file \ But you are right about one thing… [https://www.mail-archive.com/haproxy@formilux.org/msg22938.html](https://www.mail-archive.com/haproxy@formilux.org/msg22938.html) ---

**Author:** ![liam\_n](https://avatars.discourse-cdn.com/v4/letter/l/e68b1a/32.png) [@liam\_n](https://discourse.haproxy.org/u/liam_n)\ **Post date:** [June 12, 2016, 9:18am UTC](https://discourse.haproxy.org/t/haproxy-1-6-backend-sni-not-working-in-my-implementation/435/3 "2016-06-12T09:18:38Z")

Awesome, I did read that thread however it didn’t quite seem to click, my bad. Tested with my browser hitting my HAProxy frontend and I can see server name indicator fields in my TLS client hello generated by HAProxy now which is awesome. I’ll be following the release notes and that linked article for the HTTP health check, I might have to come up with a script workaround for a HTTP check that forwards SNI. In the interim though will a layer 4 health check trigger a new DNS lookup? I imagine it would have to once I’ve configured a DNS resolver. Thanks for your assistance.