Can't connect to backend server if they are using SSL with wildcard Subject Alternative Names

For some reason I get “503 Service Unavailable” when trying to reach a backend server over 443/ssl where the target server uses wildcard SSL in their Subject Alternative Names. Here’s the full config you can test out to verify. It works when trying to reach backend without SSL or with SSL that doesn’t use wildcards. See comments in backend sections. How can I make it work with backend sites that uses wildcard SSL?

global
    log /dev/log    local0
    log /dev/log    local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    timeout connect 5000
    timeout client  50000
    timeout server  50000

frontend http-in
  bind *:80
  bind *:443 ssl crt /root/cert.pem

  default_backend app6

# this works when backend server on port 80 but fails on 443
# https://10.10.1.111/data/validatorstats.json
# cert uses wildcard
backend app1
  http-request set-header Host defier.net
  server server1 defier.net:443 ssl verify none
#  server server1 defier.net:80 check

# this works: https://10.10.1.111/document/txt/example.txt
# cert is not using wildcard
backend app2
  http-request set-header Host example-files.online-convert.com
  server server2 example-files.online-convert.com:443 ssl verify none

# this fails: https://10.10.1.111/
# cert uses wildcard
backend app3
  http-request set-header Host osmosisarchive-rpc.quickapi.com
  server server3 osmosisarchive-rpc.quickapi.com:443 ssl verify none

# this fails: https://10.10.1.111/
# cert uses wildcard
backend app4
  http-request set-header Host osmosis-rpc.polkachu.com
  server server4 osmosis-rpc.polkachu.com:443 ssl verify none

# this fails: https://10.10.1.111/sample.txt
# cert uses wildcard
backend app5
  http-request set-header Host txt2html.sourceforge.net
  server server5 txt2html.sourceforge.net:443 ssl verify none

# this works: https://10.10.1.111/
# cert is not using wildcard
backend app6
  http-request set-header Host thetestdata.com
  server server6 thetestdata.com:443 ssl verify none

2 posts - 2 participants

Read full topic