Haproxy + Change Host Request Value

anexus115 · Dec 18, 2017, 8:07 PM

Hello,

I configure a ADFS service with haproxy inside pfsense.
Without SSL Offloading (Layer4 TCP) it's working fine but with certificate of web server IIS.

Now I try to activate SSL Offloading for use pfsense's certificate.
Just there are one thing specific with ADFS than in the navigator the URL https:// <ip>not working, we must aboslutly use the FQDN.

I try to found where I can define to haproxy than he must change the Host Request for use FQDN (HTTP/1.1 Host).

I try many situation and I block, now I have this config :

backend WAP_http_ipvANY
	mode			http
	log			global
	timeout connect		30000
	timeout server		30000
	retries			3
	acl			Backend1acl	hdr_beg(host) -i adfs
	http-request del-header Host  if  Backend1acl 
	http-request add-header Host adfs.domaine.com  if  Backend1acl 
	server			WAP 192.168.1.2:443 ssl  verify none

I try with http set-header or replace-header also.

Second question, where I can check if haproxy have SNI for discuss with backend server ?

Thank you for your help</ip>

PiBa · Dec 18, 2017, 9:10 PM

If it works with mode TCP, then the hostname in the http request as used by the client is apparently ok.. So in my opinion that would not need to be changed.

If SNI is required perhaps adding to the 'advanced' textbox at the server configuration something like: "sni hdr(Host)" would work.?
Something like this:

server			WAP 192.168.1.2:443 ssl  verify none sni hdr(Host)

Or make it a fixed domain name.?

server			WAP 192.168.1.2:443 ssl  verify none sni str(fs.yourdomain.tld)

anexus115 · Dec 19, 2017, 7:40 AM

Hello,

thank you for your reply.
I test hdr without success but this line working :

sni ssl_fc_sni check-sni vhost.yourdomain.local

Thank you