Use haproxy with http2 backends and non http2 backends

[bend66]

Hi,

I have an haproxy configuration where one frontend redirects to multiple backend depending on the SNI.

However I want to switch one of those backends to http2 and keep all the other on http1.1

My problem is I can’t find a way to tell haproxy that it should only accept http1 for a backend and accept http1 and http2 for the other.

Any idea if it feasible or not ?

[lukastribus]

Yes, set it up like this:

How to set ssl verify client for specific domain name

There is no simple way to do this, unfortunately. Use a TCP frontend withouth SSL termination, SNI route to different backends that recirculate to traffic to dedicated SSL frontends with different configurations. Something like: frontend port443 bind :443 tcp-request inspect-delay 5s tcp-request content accept if { req_ssl_hello_type 1 } use_backend recir_clientcertenabled if { req_ssl_sni -i test1.demo.com } default_backend recir_default backend recir_clientcertenabled …

Make sure you have dedicated certificates for HTTP/2 and HTTP/1, without overlapping SANs, otherwise SNI routing fails.

Also, yuor backend has to support HTTP/2 for this, as Haproxy doesn’t (so we need to tunnel).