Ignore / pass-through SSL for some domains and terminate / decrypt for other

[lukastribus]

Check the following post for a TCP frontend routing through different backends based on SNI and ultimately SSL-terminating it on another dedicated frontend:

How to set ssl verify client for specific domain name

There is no simple way to do this, unfortunately. Use a TCP frontend withouth SSL termination, SNI route to different backends that recirculate to traffic to dedicated SSL frontends with different configurations. Something like: frontend port443 bind :443 tcp-request inspect-delay 5s tcp-request content accept if { req_ssl_hello_type 1 } use_backend recir_clientcertenabled if { req_ssl_sni -i test1.demo.com } default_backend recir_default backend recir_clientcertenabled …

You can use the same approach to SSL terminate some domains and passthrough others.