How to check haproxy sni-based rule with curl?

I made simple HaProxy configuration to pass thorough traffic based on SNI field. Here is my haproxy.cfg

defaults
    log global
    timeout client 50s
    timeout client-fin 50s
    timeout connect 5s
    timeout server 10s
    timeout tunnel 50s
frontend tcp-0_0_0_0-443
    bind *:443
    mode tcp

    acl sni_acl_example_com req.ssl_sni -m sub example.com
    use_backend example_com_be if sni_acl_example_com

backend example_com_be
    mode tcp
    server name1 93.184.216.34

I run HaProxy using the following Dockerfile:

FROM haproxy:1.7.9-alpine
COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg
EXPOSE 443

and the following command: docker build -t my-haproxy . && docker run -p 443:443 --rm -d --name my-running-haproxy my-haproxy

Now I would like to check if the rule called sni_acl_example_com will work as expected using cURL.

curl -k -X 'GET' -H 'Host: example.com' --resolve example.com:443:127.0.0.1 https://example.com

The result is:

curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to example.com:443

Obviously the rules does not work and there is no suitable backend (that's why I get SSL_ERROR_SYSCALL). If I add some default_backend, it will be used instead to perform my request.

Why my cURL request does not open http://example.com using HaProxy?

I use curl 7.54.0 with latest OSX High Sierra.

Solution 1:

Figured it out. cURL request is absolutely correct.

There were 2 configuration statements missing in haproxy.cfg. In order to make sni-rules work you also need:

tcp-request inspect-delay 5s
tcp-request content accept if { req_ssl_hello_type 1 }

under frontend section.