# Haproxy SSL/TLS Passthrough Proxy not working?

**URL:** <https://discourse.haproxy.org/t/haproxy-ssl-tls-passthrough-proxy-not-working/7551>\
**Category:** Help!\
**Created:** [April 3, 2022, 6:13am UTC](https://discourse.haproxy.org/t/haproxy-ssl-tls-passthrough-proxy-not-working/7551 "2022-04-03T06:13:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joshua](https://avatars.discourse-cdn.com/v4/letter/j/48db29/32.png) [@Joshua](https://discourse.haproxy.org/u/Joshua)\
**Post date:** [April 3, 2022, 6:13am UTC](https://discourse.haproxy.org/t/haproxy-ssl-tls-passthrough-proxy-not-working/7551/1 "2022-04-03T06:13:34Z")

</div>

I want to setup haproxy as simple tcp-proxy. Below is my configuration. When I try to send e-mail via Thunderbird(pointing smtp to ip\_of\_my\_host:8123) or simple python script I get an error about not valid certificate or certificate error. I thought Layer 4 doesn’t care about it at all. Isn’t SSL/TLS a L7 feature? So how setup it properly?

```auto
frontend smtp
  bind *:8123
  mode tcp
  default_backend smtp-backend

  backend smtp-backend
  mode tcp
  server s1 smtp.gmail.com:465

```

> **[Using SSL Certificates with HAProxy](https://serversforhackers.com/c/using-ssl-certificates-with-haproxy)**
>
> Using HAProxy with SSL certificates, including SSL Termation and SSL Pass-Through.

> With SSL Pass-Through, no SSL certificates need to be created or used within HAproxy. The backend servers can handle SSL connections just as they would if there was only one server used in the stack without a load balancer.

So what’s wrong with my configuration? I want end smtp server to handle certificates.

---

<div class="post-metadata">

**Author:** ![Markus](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@Markus](https://discourse.haproxy.org/u/Markus)\
**Post date:** [April 4, 2022, 10:33am UTC](https://discourse.haproxy.org/t/haproxy-ssl-tls-passthrough-proxy-not-working/7551/2 "2022-04-04T10:33:35Z")

</div>

one quick guess:

your client sends request to 1.2.3.4:8123 but gets an certificate with [smtp.gmail.com](http://smtp.gmail.com). in this case “1.2.3.4” != “[smtp.gmail.com](http://smtp.gmail.com)” and so the complaint is correct. client always match the name/domain of SSL Certificate with the url/domain entered in the adress bar.