# HAProxy for converting HTTP to HTTPS request with server requiring SNI

**URL:** <https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994>\
**Category:** Help!\
**Created:** [January 15, 2018, 10:59am UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994 "2018-01-15T10:59:49Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![satya](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satya](https://discourse.haproxy.org/u/satya)\
**Post date:** [January 15, 2018, 10:59am UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/1 "2018-01-15T10:59:49Z")

</div>

Hi Team,

I have a client which can only send HTTP requests. However, the server will accept only messages from clients which can support TLS 1.2 with SNI. Without SNI, the server handshake fails.

We are trying to implement HAProxy , but no luck so far.

One question I want to check is whether HAProxy supports this kind of architecture?

Client(HTTP)—\>HAProxy(Convert into HTTPS with SSL certificates and add SNI)–\> Server

Any help would be very useful.

Regards,  
Satya

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [January 15, 2018, 11:05am UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/2 "2018-01-15T11:05:26Z")

</div>

Absolutely, it would look like this for example:

```
backend blabla
 server server1 192.168.1.10:443 ssl sni req.hdr(host)
 server server2 192.168.1.11:443 ssl sni req.hdr(host)

```

If you also want health checks with a TLS handshake (not only a connect on port 443), then you need haproxy 1.8 and the [check-sni](http://cbonte.github.io/haproxy-dconv/1.8/configuration.html#5.2-check-sni) setting.

---

<div class="post-metadata">

**Author:** ![satya](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satya](https://discourse.haproxy.org/u/satya)\
**Post date:** [January 15, 2018, 12:25pm UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/3 "2018-01-15T12:25:50Z")

</div>

Hi,

Looks like the SNI keyword is not applicable for the version I am using.

error: unknown keyword ‘sni’

HA-Proxy version 1.5.18 2016/05/10  
Build options :  
TARGET = linux2628  
CPU = generic  
CC = gcc  
CFLAGS = -O2 -g -fno-strict-aliasing  
OPTIONS = USE\_LINUX\_TPROXY=1 USE\_ZLIB=1 USE\_REGPARM=1 USE\_OPENSSL=1 USE\_PCRE=1

Default settings :  
maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 200

Encrypted password support via crypt(3): yes  
Built with zlib version : 1.2.3  
Compression algorithms supported : identity, deflate, gzip  
Built with OpenSSL version : OpenSSL 1.0.1e-fips 11 Feb 2013  
Running on OpenSSL version : OpenSSL 1.0.1e-fips 11 Feb 2013  
OpenSSL library supports TLS extensions : yes  
OpenSSL library supports SNI : yes  
OpenSSL library supports prefer-server-ciphers : yes  
Built with PCRE version : 7.8 2008-09-05  
PCRE library supports JIT : no (USE\_PCRE\_JIT not set)  
Built with transparent proxy support using: IP\_TRANSPARENT IPV6\_TRANSPARENT IP\_FREEBIND

Available polling systems :  
epoll : pref=300, test result OK  
poll : pref=200, test result OK  
select : pref=150, test result OK  
Total: 3 (3 usable), will use epoll.

---

<div class="post-metadata">

**Author:** ![satya](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satya](https://discourse.haproxy.org/u/satya)\
**Post date:** [January 15, 2018, 12:26pm UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/4 "2018-01-15T12:26:24Z")

</div>

here is the haproxy.config file details :  
global  
ssl-default-bind-options no-sslv3  
ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA

defaults  
mode http  
log global  
option httplog  
option dontlognull  
option redispatch  
retries 3  
timeout http-request 10s  
timeout queue 1m  
timeout connect 10s  
timeout client 1m  
timeout server 1m  
timeout http-keep-alive 10s  
timeout check 10s  
maxconn 3000

frontend http\_front

```
	bind localhost:443 ssl crt /etc/haproxy/certs/cert.pem
	reqadd X-Forwarded-Proto:\ https
	default_backend http_back

```

backend http\_back  
server server1 192.168.1.1:443 ca-file /etc/ssl/certs/root.pem ssl sni (server1)

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [January 15, 2018, 12:41pm UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/5 "2018-01-15T12:41:35Z")

</div>

Correct, the SNI keyword requires haproxy 1.6. It’s a fetch, so a static value would look like this:

`sni str(server1)`

---

<div class="post-metadata">

**Author:** ![satya](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satya](https://discourse.haproxy.org/u/satya)\
**Post date:** [February 12, 2018, 12:41am UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/6 "2018-02-12T00:41:14Z")

</div>

Hi Lukas,

I am running HAProxy on Linux machine. Could you please help me the documentation for upgrading from 1.5 version?

Thanks!!

Regards,  
Satya

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 12, 2018, 8:21pm UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/7 "2018-02-12T20:21:31Z")

</div>

I’m not sure I can help you. Exactly what Distribution and which release are you using?

---

<div class="post-metadata">

**Author:** ![satya](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satya](https://discourse.haproxy.org/u/satya)\
**Post date:** [February 12, 2018, 11:04pm UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/8 "2018-02-12T23:04:43Z")

</div>

Here is the version details

LSB Version: :base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch  
Distributor ID: OracleServer  
Description: Oracle Linux Server release 6.8  
Release: 6.8  
Codename: n/a

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 12, 2018, 11:09pm UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/9 "2018-02-12T23:09:07Z")

</div>

No, I don’t know that one.

---

<div class="post-metadata">

**Author:** ![satya](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satya](https://discourse.haproxy.org/u/satya)\
**Post date:** [February 14, 2018, 1:35am UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/10 "2018-02-14T01:35:30Z")

</div>

Hi,

We have uninstalled 1.5 and installed 1.7 in the Linux machine.

I am trying to use the ssl sni option to connect to the server which requires SNI for incoming traffic. Still I am facing error. Here is the logic I have put in place

frontend localhost80  
bind \*:80  
mode http  
redirect scheme https code 301 if !{ ssl\_fc }

frontend localhost443  
bind \*:443  
option tcplog  
mode tcp  
tcp-request inspect-delay 5s  
default\_backend outbound

backend outbound  
mode tcp  
option ssl-hello-chk  
server server1 10.192.1.1:443 ssl sni req.hdr(server1)

Please let me know if I am doing it correct

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 14, 2018, 8:56am UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/11 "2018-02-14T08:56:40Z")

</div>

No, you either specify a static string like I suggested: `ssl sni str(server1)`  
Or you use the host header: `ssl sni req.hdr(host)`

However you seem to set the SNI value to the content of the http header “server1”, which very likely does not exist and you just confused strings with http headers.

---

<div class="post-metadata">

**Author:** ![satya](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satya](https://discourse.haproxy.org/u/satya)\
**Post date:** [February 15, 2018, 1:40am UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/12 "2018-02-15T01:40:43Z")

</div>

Now getting a different error.

curl: (51) SSL: certificate subject name ‘\*.sdppcf.com’ does not match target host name ‘[test.dc.com](http://test.dc.com)’

curl to the server1 directly is working fine without passing any certs.

Is there a way to pass the cacert in the backend?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 15, 2018, 4:57am UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/13 "2018-02-15T04:57:35Z")

</div>

This all depends on your configuration and your backend. Did you use req.hdr(host)?

---

<div class="post-metadata">

**Author:** ![satya](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satya](https://discourse.haproxy.org/u/satya)\
**Post date:** [February 15, 2018, 5:42am UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/14 "2018-02-15T05:42:41Z")

</div>

Nope, we have used sni str(server1).

```
   server test.sdppcf.com 10.192.1.1:443 sni str(test.sdppcf.com)
```

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 15, 2018, 10:22am UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/15 "2018-02-15T10:22:02Z")

</div>

Ok. Then please use `req.hdr(host)` instead.

---

<div class="post-metadata">

**Author:** ![satya](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satya](https://discourse.haproxy.org/u/satya)\
**Post date:** [February 15, 2018, 11:50am UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/16 "2018-02-15T11:50:46Z")

</div>

Apologies. I didn’t get you. req.hdr(host) would fetch the host name from the HTTP header isnt it.

As I have informed earlier - below would be the flow.

Client(HTTP)—\>HAProxy(Convert into HTTPS with SSL certificates and add SNI)–\> Server([sdppcf.com](http://sdppcf.com))

As client system doesn’t support SNI, the onus is on the HAProxy code to add the SNI before it makes a call to the server.

Can I add the “http-request set-header Host [test.sdppcf.com](http://test.sdppcf.com)” in the frontend and use it?

# Summary of the frontend and backend:

frontend localhost80  
bind \*:80  
mode http  
redirect scheme https code 301 if !{ ssl\_fc }

frontend localhost443  
bind \*:443  
_**http-request set-header Host [test.sdppcf.com](http://test.sdppcf.com)**_  
option tcplog  
mode tcp  
tcp-request inspect-delay 5s  
default\_backend outbound

backend outbound  
mode tcp  
option ssl-hello-chk  
**_server server1 10.192.1.1:443 ssl sni req.hdr(Host) check -CAfile /etc/haproxy/certs/server1.pem_**

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 15, 2018, 12:53pm UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/17 "2018-02-15T12:53:42Z")

</div>

What is the SNI value that your backend requires to **serve the correct certificate**?

---

<div class="post-metadata">

**Author:** ![satya](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satya](https://discourse.haproxy.org/u/satya)\
**Post date:** [February 15, 2018, 1:51pm UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/18 "2018-02-15T13:51:06Z")

</div>

SNI value that the server is looking for is [test.sdppcf.com](http://test.sdppcf.com)

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 15, 2018, 5:06pm UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/19 "2018-02-15T17:06:07Z")

</div>

Then `sni str(test.sdppcf.com)` is correct and that is the certificate that is delivered. Double check your curl command you used and which failed for you.

---

<div class="post-metadata">

**Author:** ![satya](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satya](https://discourse.haproxy.org/u/satya)\
**Post date:** [February 16, 2018, 1:02am UTC](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994/20 "2018-02-16T01:02:00Z")

</div>

still facing issues  
**curl output:**  
[root@localhost haproxy]# curl -X GET [https://localhost/health](https://localhost/health)  
curl: (51) SSL: certificate subject name ‘\*.sdppcf.com’ does not match target host name ‘localhost’

**browser ouput:**  
404 Not Found: Requested route (‘localhost’) does not exist.  
when pressed F12 to see certificate details in the browser ,it gives this error ERR\_CERT\_COMMON\_NAME\_INVALID

[Next page](https://discourse.haproxy.org/t/haproxy-for-converting-http-to-https-request-with-server-requiring-sni/1994.md?page=2)