# Use mapping for req.ssl\_sni instead of req.hdr(host)?
**URL:** https://discourse.haproxy.org/t/use-mapping-for-req-ssl-sni-instead-of-req-hdr-host/2016
**Category:** Help!
**Created:** [January 19, 2018, 2:46pm UTC](https://discourse.haproxy.org/t/use-mapping-for-req-ssl-sni-instead-of-req-hdr-host/2016 "2018-01-19T14:46:29Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@hookprocess](https://discourse.haproxy.org/u/hookprocess)
#### Post date: [January 19, 2018, 2:46pm UTC](https://discourse.haproxy.org/t/use-mapping-for-req-ssl-sni-instead-of-req-hdr-host/2016/1 "2018-01-19T14:46:29Z")
I have a frontend in http mode where I use this with great success:
use\_backend %[req.hdr(host),lower,map\_dom(/etc/haproxy/maps.map,be\_default)]
Is it possible to do the same for tcp mode and do mapping on req.ssl\_sni somehow?
(HA-Proxy version 1.7.5-2 2017/05/17)
---
### Author:  [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [January 19, 2018, 3:17pm UTC](https://discourse.haproxy.org/t/use-mapping-for-req-ssl-sni-instead-of-req-hdr-host/2016/2 "2018-01-19T15:17:58Z")
Yes, but [req.ssl\_sni](http://cbonte.github.io/haproxy-dconv/1.7/configuration.html#7.3.5-req.ssl_sni) is for TCP mode without SSL termination.
Use [ssl\_fc\_sni](http://cbonte.github.io/haproxy-dconv/1.7/configuration.html#7.3.4-ssl_fc_sni) to get the SNI value of a SSL terminated sessions.
I would strongly recommend to not do this however. If you have certificates with multiple SAN’s or wildcard certificates you may end up routing to the wrong backend. Please always use the host header when you are routing HTTP traffic.
---
### Author:  [@Rickard\_505](https://discourse.haproxy.org/u/Rickard_505)
#### Post date: [December 13, 2023, 12:33pm UTC](https://discourse.haproxy.org/t/use-mapping-for-req-ssl-sni-instead-of-req-hdr-host/2016/3 "2023-12-13T12:33:01Z")
Anyone having a working example of this, since i can not get **ssl\_fc\_sni** to work with any dynamic solution, direct map or thru map file, however it works perfectly when doing ACL’s
like: _ **ssl\_fc\_sni -i demo.abc.xyz** _
---
### Author:  [@Rickard\_505](https://discourse.haproxy.org/u/Rickard_505)
#### Post date: [December 21, 2023, 2:04pm UTC](https://discourse.haproxy.org/t/use-mapping-for-req-ssl-sni-instead-of-req-hdr-host/2016/4 "2023-12-21T14:04:22Z")
Unfortunatly I can’t use host header for the DDP Websocket traffic iam routing.
the ssl\_fc\_sni works perfectly in an acl / action - but i can’t seem to get a dynamic solution to work.