# SNI routing to servers - only ever sent to first server

**URL:** <https://discourse.haproxy.org/t/sni-routing-to-servers-only-ever-sent-to-first-server/1265>\
**Category:** Help!\
**Created:** [May 25, 2017, 6:31am UTC](https://discourse.haproxy.org/t/sni-routing-to-servers-only-ever-sent-to-first-server/1265 "2017-05-25T06:31:40Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 26, 2017, 7:38am UTC](https://discourse.haproxy.org/t/sni-routing-to-servers-only-ever-sent-to-first-server/1265/4 "2017-05-26T07:38:02Z")

</div>

Yes, if the certificates matches both hostnames (for example due to a wildcart certificate or multiple SAN’s), the browser will use the same TLS session for both hostnames. This is an important thing to keep in mind, when using SNI to route between backends.

If [cloud.domain.com.au](http://cloud.domain.com.au) and [support.domain.com.au](http://support.domain.com.au) are never requested from the same browser/client, this issue may not present itself. But if it is, its likely request will be routed to the wrong backend.

Indeed, terminating TLS on haproxy and using the Host header to route the traffic to the correct backend is what fixes this issue, regardless of the certificate.

---

_[View the full topic](https://discourse.haproxy.org/t/sni-routing-to-servers-only-ever-sent-to-first-server/1265)._