# Use\_backend app-main if { hdr\_dom(host) -i } -\> Not recognize domain

**URL:** <https://discourse.haproxy.org/t/use-backend-app-main-if-hdr-dom-host-i-not-recognize-domain/4480>\
**Category:** Help!\
**Created:** [November 7, 2019, 9:03am UTC](https://discourse.haproxy.org/t/use-backend-app-main-if-hdr-dom-host-i-not-recognize-domain/4480 "2019-11-07T09:03:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![bastify](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/bastify/32/1017_2.png) [@bastify](https://discourse.haproxy.org/u/bastify)\
**Post date:** [November 7, 2019, 9:03am UTC](https://discourse.haproxy.org/t/use-backend-app-main-if-hdr-dom-host-i-not-recognize-domain/4480/1 "2019-11-07T09:03:22Z")

</div>

Hi,

With the next conf haproxy not recognize my domains and all HTTPS traffic goes to default backend. Any help is appreciated.

# Global settings

#---------------------------------------------------------------------  
global  
log 127.0.0.1 local2 #Log configuration

```
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy #Haproxy running under user and group "haproxy"
group haproxy
daemon

# turn on stats unix socket
stats socket /var/lib/haproxy/stats

```

#---------------------------------------------------------------------

# defaults

#---------------------------------------------------------------------  
defaults  
mode http  
log global  
option tcplog  
option dontlognull  
option http-server-close  
option forwardfor except 127.0.0.0/8  
option redispatch  
retries 3  
timeout http-request 10s  
timeout queue 1m  
timeout connect 10s  
timeout client 1m  
timeout server 1m  
timeout http-keep-alive 10s  
timeout check 10s  
maxconn 3000

#---------------------------------------------------------------------

# FrontEnd Configuration

#---------------------------------------------------------------------  
frontend main-http  
bind \*:80  
reqadd X-Forwarded-Proto:\ http  
#acl host\_dirbit hdr(host) -i [directoriobitcoin.com](http://directoriobitcoin.com)  
use\_backend app-main if { hdr\_dom(host) -i [directoriobitcoin.com](http://directoriobitcoin.com) }  
use\_backend app-main-bm if { hdr\_dom(host) -i [bemadrid.com](http://bemadrid.com) }  
use\_backend app-main-mh if { hdr\_dom(host) -i [madridhappypeople.com](http://madridhappypeople.com) }  
default\_backend app-main

frontend main-https  
bind \*:443  
reqadd X-Forwarded-Proto:\ https  
mode tcp  
use\_backend app-main-https if { hdr\_dom(Host) -i [directoriobitcoin.com](http://directoriobitcoin.com) }  
use\_backend app-main-bm-https if { hdr\_dom(Host) -i [bemadrid.com](http://bemadrid.com) }  
use\_backend app-main-mh-https if { hdr\_dom(Host) -i [madridhappypeople.com](http://madridhappypeople.com) }  
**default\_backend app-main-https**

#---------------------------------------------------------------------

# BackEnd roundrobin as balance algorithm

#---------------------------------------------------------------------  
backend app-main  
balance roundrobin  
server cpanel1 31.200.246.100:80 check  
server cpanel2 92.222.66.209:80 check

**backend app-main-https**  
balance roundrobin  
mode tcp  
server cpanel1 31.200.246.100:443 check  
server cpanel2 92.222.66.209:443 check

backend app-main-bm  
balance roundrobin  
server cpanel1 31.200.246.100:80 check  
server cpanel2 92.222.66.209:80 check

backend app-main-bm-https  
balance roundrobin  
mode tcp  
server cpanel1 31.200.246.100:443 check  
server cpanel2 92.222.66.209:443 check

backend app-main-mh  
balance roundrobin  
server cpanel1 31.200.246.100:80 check  
server cpanel2 92.222.66.209:80 check

backend app-main-mh-https  
balance roundrobin  
mode tcp  
server cpanel1 31.200.246.100:443 check  
server cpanel2 92.222.66.209:443 check

---

<div class="post-metadata">

**Author:** ![jerome](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/jerome/32/984_2.png) [@jerome](https://discourse.haproxy.org/u/jerome)\
**Post date:** [November 7, 2019, 1:27pm UTC](https://discourse.haproxy.org/t/use-backend-app-main-if-hdr-dom-host-i-not-recognize-domain/4480/2 "2019-11-07T13:27:47Z")

</div>

you can’t use hdr\_dom in the https frontend because you don’t terminate SSL.  
you can use req.ssl\_sni instead but some clients don’t send SNI in the client hello.

---

<div class="post-metadata">

**Author:** ![bastify](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/bastify/32/1017_2.png) [@bastify](https://discourse.haproxy.org/u/bastify)\
**Post date:** [November 7, 2019, 1:29pm UTC](https://discourse.haproxy.org/t/use-backend-app-main-if-hdr-dom-host-i-not-recognize-domain/4480/3 "2019-11-07T13:29:06Z")

</div>

> [@jerome](#):
>
> req.ssl\_sni

Well, how can I route using the domain?

---

<div class="post-metadata">

**Author:** ![jerome](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/jerome/32/984_2.png) [@jerome](https://discourse.haproxy.org/u/jerome)\
**Post date:** [November 7, 2019, 1:30pm UTC](https://discourse.haproxy.org/t/use-backend-app-main-if-hdr-dom-host-i-not-recognize-domain/4480/4 "2019-11-07T13:30:41Z")

</div>

like you did with hdr.  
`use_backend foo if { req.ssl_sni bar }`

---

<div class="post-metadata">

**Author:** ![bastify](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/bastify/32/1017_2.png) [@bastify](https://discourse.haproxy.org/u/bastify)\
**Post date:** [November 7, 2019, 1:31pm UTC](https://discourse.haproxy.org/t/use-backend-app-main-if-hdr-dom-host-i-not-recognize-domain/4480/5 "2019-11-07T13:31:54Z")

</div>

And what can I do with the clients don’t send SNI in the client hello

---

<div class="post-metadata">

**Author:** ![jerome](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/jerome/32/984_2.png) [@jerome](https://discourse.haproxy.org/u/jerome)\
**Post date:** [November 7, 2019, 1:33pm UTC](https://discourse.haproxy.org/t/use-backend-app-main-if-hdr-dom-host-i-not-recognize-domain/4480/6 "2019-11-07T13:33:40Z")

</div>

You don’t support them unless you can dedicate an IP per domain and then you can route based on the IP clients connected to.