# Selective ALPN based on host header

**URL:** <https://discourse.haproxy.org/t/selective-alpn-based-on-host-header/4595>\
**Category:** Help!\
**Created:** [December 4, 2019, 9:13pm UTC](https://discourse.haproxy.org/t/selective-alpn-based-on-host-header/4595 "2019-12-04T21:13:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shamsimam](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/shamsimam/32/745_2.png) [@shamsimam](https://discourse.haproxy.org/u/shamsimam)\
**Post date:** [December 4, 2019, 9:13pm UTC](https://discourse.haproxy.org/t/selective-alpn-based-on-host-header/4595/1 "2019-12-04T21:13:59Z")

</div>

I have two names, [h1.app.com](http://h1.app.com) and [h2.app.com](http://h2.app.com), pointing to the same haproxy instance.  
haproxy is listening on port 80 and 443.  
How do I ensure that SSL requests for:

- [h1.app.com](http://h1.app.com) are not upgraded to http/2 via alpn,
- [h2.app.com](http://h2.app.com) are upgraded to http/2 via alpn.

The basic configuration I have is below, but not sure how to disable alpn for specific host (i.e. [h1.app.com](http://h1.app.com)) headers:

```
defaults
    mode http
    option http-use-htx
    ...

frontend f_all
    maxconn 20000
    bind *:80
    bind *:443 ssl crt-list /haproxy/crt-list strict-sni alpn h2,http/1.1
    bind *:8080 proto h2
    mode http
    ...
    acl is-http2 fc_http_major 2
    use_backend b_h2 if is-http2
    default_backend b_h1

backend b_h1
    mode http
    balance roundrobin
    server 123.45.67.890:12324 123.45.67.890:12345 check

backend b_h2
    mode http
    balance roundrobin
    server 123.45.67.890:12326 123.45.67.890:12346 check
```

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [December 4, 2019, 10:11pm UTC](https://discourse.haproxy.org/t/selective-alpn-based-on-host-header/4595/2 "2019-12-04T22:11:23Z")

</div>

Make sure you have dedicated (so non-overlapping) certificates and configure them via [crt-list](https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#5.1-crt-list), so you can configure per certificate alpn settings.

---

<div class="post-metadata">

**Author:** ![shamsimam](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/shamsimam/32/745_2.png) [@shamsimam](https://discourse.haproxy.org/u/shamsimam)\
**Post date:** [December 4, 2019, 10:52pm UTC](https://discourse.haproxy.org/t/selective-alpn-based-on-host-header/4595/3 "2019-12-04T22:52:06Z")

</div>

Sweet! I’ll try it out. Thanks.

---

<div class="post-metadata">

**Author:** ![shamsimam](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/shamsimam/32/745_2.png) [@shamsimam](https://discourse.haproxy.org/u/shamsimam)\
**Post date:** [January 6, 2020, 7:29pm UTC](https://discourse.haproxy.org/t/selective-alpn-based-on-host-header/4595/4 "2020-01-06T19:29:08Z")

</div>

I got this working by adding the necessary alpn section in my crt-list file. Thank you very much!