# HAProxy 1.6 with SNI and different SSL Settings per hostname

**URL:** <https://discourse.haproxy.org/t/haproxy-1-6-with-sni-and-different-ssl-settings-per-hostname/698>\
**Category:** Help!\
**Created:** [October 5, 2016, 12:50pm UTC](https://discourse.haproxy.org/t/haproxy-1-6-with-sni-and-different-ssl-settings-per-hostname/698 "2016-10-05T12:50:35Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 5, 2016, 4:49pm UTC](https://discourse.haproxy.org/t/haproxy-1-6-with-sni-and-different-ssl-settings-per-hostname/698/2 "2016-10-05T16:49:44Z")

</div>

Its not supported the way you use it. They sequence of keywords in the bind configuration line is irrelevant.

For example, specifying strict-sni twice doesn’t make any difference, its not a per certificate configuration.

And that is also valid for the client certificate authentication, so if you specify it, you are enabling it for everything.

Workarounds:

- use a different IP or port for each cert (so it is a different bind line and you can therefor apply the configuration you need on a per certificate/“bind” basis)
- if you need everything on a single IP:port combination, the only way to achieve this currently with haproxy is to configure the frontend as TCP mode without any SSL and switching to different TCP backends based on SNI values and then configure those TCP backends to point to dedicated SSL frontends, where you have a different SSL configuration (with and without client certificates). You can use unix sockets or linux abstrace namespace sockets, instead of using the loopback TCP stack.

Thats a complicated setup, but it is the only way if you need full per certificate flexibility on a single IP:port combination.  
For details see those 3 links:

> **[Enhanced SSL Load Balancing with Server Name Indication (SNI) TLS Extension -...](https://www.haproxy.com/blog/enhanced-ssl-load-balancing-with-server-name-indication-sni-tls-extension/)**
>
> Synopsis Some time ago, we wrote an article which explained how to load-balance SSL services, maintaining affinity using the SSLID. The main limitation of this kind of architecture is that you must dedicate a public IP address and port per service....

  
[http://cbonte.github.io/haproxy-dconv/1.6/configuration.html#4.2-bind](http://cbonte.github.io/haproxy-dconv/1.6/configuration.html#4.2-bind)  
[http://www.serverphorums.com/read.php?10,967239](http://www.serverphorums.com/read.php?10,967239)

There is a proposal to fix this properly, however it is in development and it could take some time until this is implemented and made its way to a stable haproxy release:

[https://www.mail-archive.com/haproxy@formilux.org/msg23747.html](https://www.mail-archive.com/haproxy@formilux.org/msg23747.html)

---

_[View the full topic](https://discourse.haproxy.org/t/haproxy-1-6-with-sni-and-different-ssl-settings-per-hostname/698)._