The ngx_stream_ssl_preread_module
module (1.11.5) allows extracting information from the ClientHello message without terminating SSL/TLS, for example, the sever name requested through SNI or protocols advertised in ALPN. This module is not built by default, it should be enabled with the --with-stream_ssl_preread_module
configuration parameter.
Selecting an upstream based on server name:
map $ssl_preread_server_name $name { backend.example.com backend; default backend2; } upstream backend { server 192.168.0.1:12345; server 192.168.0.2:12345; } upstream backend2 { server 192.168.0.3:12345; server 192.168.0.4:12345; } server { listen 12346; proxy_pass $name; ssl_preread on; }
Selecting an upstream based on protocol:
map $ssl_preread_alpn_protocols $proxy { ~\bh2\b 127.0.0.1:8001; ~\bhttp/1.1\b 127.0.0.1:8002; ~\bxmpp-client\b 127.0.0.1:8003; } server { listen 9000; proxy_pass $proxy; ssl_preread on; }
Selecting an upstream based on SSL protocol version:
map $ssl_preread_protocol $upstream { "" ssh.example.com:22; "TLSv1.2" new.example.com:443; default tls.example.com:443; } # ssh and https on the same port server { listen 192.168.0.1:443; proxy_pass $upstream; ssl_preread on; }
Syntax: | ssl_preread on | off; |
---|---|
Default: | ssl_preread off; |
Context: | stream , server |
Enables extracting information from the ClientHello message at the preread phase.
$ssl_preread_protocol
$ssl_preread_server_name
$ssl_preread_alpn_protocols
© 2002-2018 Igor Sysoev
© 2011-2018 Nginx, Inc.
Licensed under the BSD License.
https://nginx.org/en/docs/stream/ngx_stream_ssl_preread_module.html