# TLS frontend + backend; host-header proxying?

**URL:** <https://discourse.haproxy.org/t/tls-frontend-backend-host-header-proxying/4601>\
**Category:** Help!\
**Created:** [December 5, 2019, 5:39pm UTC](https://discourse.haproxy.org/t/tls-frontend-backend-host-header-proxying/4601 "2019-12-05T17:39:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alexr92](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/alexr92/32/1038_2.png) [@alexr92](https://discourse.haproxy.org/u/alexr92)\
**Post date:** [December 5, 2019, 5:39pm UTC](https://discourse.haproxy.org/t/tls-frontend-backend-host-header-proxying/4601/1 "2019-12-05T17:39:30Z")

</div>

I’m doing TLS termination on a frontend, and using the host-header with a domain map to forward to a backend pool of servers. The servers on the backend have names like [worker1.myapp.company.net](http://worker1.myapp.company.net), but the host header is something like [www.myapp.com](http://www.myapp.com).

I’ve verified that it is using the correct backend when requests go to [www.myapp.com](http://www.myapp.com), and TLS serves correctly.

The issue is that requests to the backend worker servers are using the SNI and/or host header for [worker1.myapp.company.net](http://worker1.myapp.company.net), instead of [www.myapp.com](http://www.myapp.com), which is what the worker servers expect. I ran wireshark on the backend server and was able to see this SNI value, too.

Is there a way to change both requests and health checks on the backend so that they use the SNI and Host Header values that came to the frontend in the first place? There will be dozens of domains going through this front-end and back-end, so I can’t hardcode domain values either.

---

<div class="post-metadata">

**Author:** ![alexr92](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/alexr92/32/1038_2.png) [@alexr92](https://discourse.haproxy.org/u/alexr92)\
**Post date:** [December 5, 2019, 5:50pm UTC](https://discourse.haproxy.org/t/tls-frontend-backend-host-header-proxying/4601/2 "2019-12-05T17:50:07Z")

</div>

Ah, of course I figured it out now. Had to add sni req.hdr(host) to each backend server. Config looks like this:

global  
…  
ca-base /etc/ssl/certs  
…

frontend HTTPS-Frontend-DefaultHTTPS  
bind x.x.x.x:443 ssl crt /etc/ssl/chained  
mode http  
use\_backend %[req.hdr(host),lower,map\_dom(/etc/haprox/domain-backend.map)]

backend MyApp-Servers  
mode http  
balance roundrobin  
option forwardfor  
server worker01 [worker01.prod.myapp.apps.company.net:443](http://worker01.prod.myapp.apps.company.net:443) ssl verify required ca-file ca-certificates.crt sni req.hdr(host)  
server worker02 [worker02.prod.myapp.apps.company.net:443](http://worker02.prod.myapp.apps.company.net:443) ssl verify required ca-file ca-certificates.crt sni req.hdr(host)