Nginx proxy based on SNI without decryption
Solution 1:
NO, you can't do with Nginx. By default, Nginx is always decrypting content, so Nginx can apply request routing. Some solution that can be tried:
-
There are 3rd party module called nginx_tcp_proxy_module. I haven't tried it yet. Because that module do proxy on network layer, so it will passing request without decryption.
-
The preferred solution is use HAProxy. This tutorial suggest that you can do TCP proxy with SNI capabilities.
Sidenote
By default, Nginx always act as SSL offloading/decryption process on proxy. Here some the advantages doing SSL offloading (taken from here)
- Improved performance
- Better utilization of the backend servers
- Intelligent routing
- Certificate management
- Security patches
Solution 2:
It looks like this is now supported using the ngx_stream_ssl_preread_module module