]> git.ipfire.org Git - thirdparty/haproxy.git/commit
MEDIUM: httpcheck/ssl: Base the SNI value on the HTTP host header by default
authorChristopher Faulet <cfaulet@haproxy.com>
Thu, 4 Sep 2025 10:13:54 +0000 (12:13 +0200)
committerChristopher Faulet <cfaulet@haproxy.com>
Fri, 5 Sep 2025 13:56:42 +0000 (15:56 +0200)
commitffc1f096e00def9a69f5898063d03cebf55cdbca
treea8bbe4184209b0d3e94e0c1ca55d615350e496c4
parent668916c1a2fc2180028ae051aa805bb71c7b690b
MEDIUM: httpcheck/ssl: Base the SNI value on the HTTP host header by default

Similarly to the automic SNI selection for regulat SSL traffic, the SNI of
health-checks HTTPS connection is now automatically set by default by using
the host header value. "check-sni-auto" and "no-check-sni-auto" server
settings were added to change this behavior.

Only implicit HTTPS health-checks can take advantage of this feature. In
this case, the host header value from the "option httpchk" directive is used
to extract the SNI. It is disabled if http-check rules are used. So, the SNI
must still be explicitly specified via a "http-check connect" rule.

This patch with should paritally fix the issue #3081.
doc/configuration.txt
include/haproxy/server-t.h
include/haproxy/tcpcheck-t.h
src/cfgparse-ssl.c
src/tcpcheck.c