4 ms·

Checked out ngx_stream_ssl_preread_module but not sure about the use case. Anyone?

• an_account_name 10y ago
  It exposes a variable with the TLS SNI extension value for you to do stuff with in config: http://nginx.org/en/docs/stream/ngx_stream_ssl_preread_module.html http://nginx.org/en/docs/stream/ngx_stream_ssl_preread_modul... It's not clear from config whether you had to have already presented a valid certificate at that phase, though, or if it's just something you can use to check if it agrees with the Host header.
  • brazzledazzle 10y ago
    You couldn't do this before? I thought it already had parity with haproxy in this respect.
  • kpcyrd 10y ago
    this is spot on nginx is able to forward tcp streams without negotiating https or expecting http, from the docs it looks like this is for tcp streams only.
    • jpgvm 10y ago
      It has to be for TCP only because it can't do L7 balancing without terminating TLS.
• rossy 10y ago
  I'm not totally sure, but it seems like it allows you to peek at the ClientHello message at the start of a TLS stream without performing a TLS handshake or otherwise interrupting the stream, so it can be forwarded with encryption to a backend server. For clients with Server Name Indication support (most of them,) the ClientHello message includes the unencrypted hostname of the server the client wants to connect to, so you could use it to route requests for different hosts to different internal servers in a virtual hosting/reverse proxy scenario (eg. requests for app1.com go to a different backend server than requests for app2.com) without Nginx having to decrypt the body of the requests at all.