SSL Termination with exception for a specific domain Wildcard SSL-Certificate request

[lukastribus]

You are binding twice to port 443, you cannot do that. Your OS will load-balance between the two frontend which is absolutely NOT what you want.

You need a single frontend on port 443, in TCP mode, which is looking at the SNI value for routing decision making. For domains that you want to terminate locally, you need to define a backend that reconnects to a SSL terminating frontend with your configuration.

So for example:

• move the frontend load-balancer from port *:443 to 127.0.0.1:1443
• create a backend in tcp mode to reconnect to 127.0.0.1:1443
• use that backend as a default_backend in wildcard_tcp, as opposed to webservers

Also see this example (slightly different use-case):

How to set ssl verify client for specific domain name

There is no simple way to do this, unfortunately. Use a TCP frontend withouth SSL termination, SNI route to different backends that recirculate to traffic to dedicated SSL frontends with different configurations. Something like: frontend port443 bind :443 tcp-request inspect-delay 5s tcp-request content accept if { req_ssl_hello_type 1 } use_backend recir_clientcertenabled if { req_ssl_sni -i test1.demo.com } default_backend recir_default backend recir_clientcertenabled …