使用nginx和SNI进行SSL端口统一

Question

I have a number of separate SSL servers on my internal network which I want to expose to the public Internet on a single IP address and port. All my clients are guaranteed to support the server_name TLS extension (akaServer Name Indication or SNI).

What I imagine is, that nginx will look at the TLS client hello message of an incoming connection and figure out which internal IP to forward the connection to. Then nginx acts as a TCP tunnel, ie nginx itself is not participating in any TLS sessions (even though it peeks into incoming TLS client hello messages!), and needs no SSL cert or private key of its own.

In other words, the TLS session is initiated on the client, passes-thru nginx (which multiplexes the destinations using the server_name information in TLS client hello) and terminates in the destination server.

Can this be done with nginx and how? If not, are you aware of some other proxy software that can do this?

Best Regards,
rkpr

Answer 1

It seems haproxy can do exactly that like this:

use-server srv1 if { req_ssl_sni -i hostname1 }
server     srv1 192.168.0.1:443 weight 0