# HAProxy with TCP mode and multiple subdomains

**URL:** <https://discourse.haproxy.org/t/haproxy-with-tcp-mode-and-multiple-subdomains/7140>\
**Category:** Help!\
**Created:** [November 25, 2021, 3:00pm UTC](https://discourse.haproxy.org/t/haproxy-with-tcp-mode-and-multiple-subdomains/7140 "2021-11-25T15:00:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rautpr](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@rautpr](https://discourse.haproxy.org/u/rautpr)\
**Post date:** [November 25, 2021, 3:00pm UTC](https://discourse.haproxy.org/t/haproxy-with-tcp-mode-and-multiple-subdomains/7140/1 "2021-11-25T15:00:57Z")

</div>

Hi Team, I have the below configuration and getting SSL error in my python code.

> frontend http-in  
> bind \*:443  
> mode tcp  
> option tcplog  
> timeout connect 10s  
> timeout client 20m  
> timeout server 20m  
> maxconn 10000  
> acl sub\_qaws hdr(host) -i [qaws.domain.com](http://qaws.domain.com)  
> acl sub\_pdws hdr(host) -i [pdws.domain.com](http://pdws.domain.com)  
> use\_backend be\_d1 if sub\_qaws  
> use\_backend be\_d2 if sub\_pdws  
> backend be\_d1  
> server D1M1 [qaws.domain.com:443](http://qaws.domain.com:443)  
> backend be\_d2  
> server D2M1 [pdws.domain.com:443](http://pdws.domain.com:443)

Error Message:  
Caused by SSLError(SSLEOFError(8, ‘EOF occurred in violation of protocol (\_ssl.c:1131)’))

But if I removed ACL entry and just keep a single backend server then it worked perfectly fine.

Can someone please help here and let me know the exact root cause of this issue.

---

<div class="post-metadata">

**Author:** ![jerome](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/jerome/32/984_2.png) [@jerome](https://discourse.haproxy.org/u/jerome)\
**Post date:** [November 25, 2021, 3:40pm UTC](https://discourse.haproxy.org/t/haproxy-with-tcp-mode-and-multiple-subdomains/7140/2 "2021-11-25T15:40:52Z")

</div>

you can’t use `hdr(host)` based ACLs here as haproxy does not see the HTTP requests/responses because it does not terminate TLS.

Either you terminate TLS, or you use the SNI for your use\_backend rules, with [req.ssl\_sni](https://cbonte.github.io/haproxy-dconv/2.4/configuration.html#7.3.5-req.ssl_sni)

`use_backend be_d1 if { req.ssl_sni qaws.domain.com }`

---

<div class="post-metadata">

**Author:** ![rautpr](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@rautpr](https://discourse.haproxy.org/u/rautpr)\
**Post date:** [November 26, 2021, 7:59am UTC](https://discourse.haproxy.org/t/haproxy-with-tcp-mode-and-multiple-subdomains/7140/3 "2021-11-26T07:59:27Z")

</div>

Hi Jerome,

Thanks for your input. I tried the below configuration and it’s working in round-robin fashion instead of going with the exact match.

> listen abc  
> bind \*:443  
> mode tcp  
> option tcplog  
> timeout connect 10s  
> timeout client 20m  
> timeout server 20m  
> maxconn 10000  
> use-server abc1 if { req.ssl\_sni -i [qaws.domain.com](http://qaws.domain.com) }  
> server abc1 [qaws.domain.com:443](http://qaws.domain.com:443)  
> use-server abc2 if { req.ssl\_sni -i [pdws.domain.com](http://pdws.domain.com) }  
> server abc2 [pdws.domain.com:443](http://pdws.domain.com:443)