I am setting up HaProxy for https in passthrough (tcp) mode without SSL/TLS termination. I want to be able to route traffic to different backends based on hostname requested by a client.

From HaProxy documentation I learned that there is unencrypted SNI field that I can use to setup ACL rule.

My question is: Do most of the browser supporting SNI feature, send this field by default? Do other tools like curl or wget send it too?


All modern browser support SNI and use it by default (there is probably not even a away to switch it off). Current versions of most tools like curl use SNI too by default, but not all. For example with openssl s_client you explicitly need to specify -servername ...if you want to use SNI and in some programming languages SNI is only used by default if you use higher level HTTP libraries but not if you just use the lower level TLS bindings.

For more information see also SSLLabs: User Agent Capabilities.

  • For Java over about the last year there was a bug where HttpsURLConnection failed to send SNI if you used a nondefault HostNameVerifier; there are about half a dozen Qs on SO about problems caused by this. (Now fixed.) – dave_thompson_085 Oct 16 '17 at 2:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.