The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Yes. HAProxy can proxy requests to HTTPS backends by adding ssl to each backend server line. For a production deployment, add verify required and a trusted CA source such as ca-file or @system-ca. If the backend chooses its certificate or virtual host from SNI, pass the request hostname with sni req.hdr(Host); HAProxy 3.3 and newer can derive that SNI automatically from the HTTP Host header.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What an HTTPS backend means in HAProxy
In a conventional reverse-proxy setup, a client connects to HAProxy and HAProxy opens a second connection to an application server. When the backend connection uses HTTPS, the second connection is encrypted with TLS instead of plain HTTP. The client-side and backend-side sessions are independent.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
That lets HAProxy terminate TLS at the edge, inspect or route HTTP requests, and then encrypt the hop from HAProxy to the application server. It also lets HAProxy pass traffic to an HTTPS service without terminating client TLS at the same point, depending on how the frontend is configured.
- Client-side TLS: configured on a frontend such as
bind :443 ssl crt .... - Backend TLS: configured separately with
sslon eachserverline. - Certificate policy: controlled with
verify required,verify none, and a CA source. - Hostname indication: supplied with SNI when the backend hosts several HTTPS names.
Port 443 is the usual HTTPS backend port, but HAProxy can use TLS on any port where the server is listening for it.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Minimal configuration for an HTTPS backend
This is the standard HTTP-mode pattern with certificate validation and explicit SNI:
backend webservers
mode http
balance roundrobin
server web1 10.0.0.5:443 ssl verify required ca-file /myca.pem sni req.hdr(Host)
server web2 10.0.0.6:443 ssl verify required ca-file /myca.pem sni req.hdr(Host)The options have distinct jobs:
sslmakes HAProxy establish TLS to the listed server instead of sending clear-text HTTP.verify requiredmakes HAProxy reject a backend certificate that cannot be validated.ca-file /myca.pempoints to the CA bundle used to build the backend certificate’s trust chain.sni req.hdr(Host)puts the incoming HTTP host value in the TLS ClientHello’s Server Name Indication field.
Keep the backend in mode http when HAProxy must parse HTTP headers, perform HTTP routing, or forward the original host. A TCP-mode design is possible for pass-through use cases, but it does not provide the same HTTP-layer visibility.
How to validate backend certificates
Use a trusted CA in production
Certificate validation is a separate decision from enabling encryption. A TLS tunnel can be encrypted while still accepting an untrusted or incorrect certificate. The safer production combination is verify required plus a CA bundle that contains the issuer of the backend certificate.
You can provide a custom bundle:
server app1 10.0.0.5:443 ssl verify required ca-file /etc/haproxy/backend-ca.pemOr use the system CA store:
server app1 10.0.0.5:443 ssl verify required ca-file @system-caThe CA file must be readable by the HAProxy process and must contain the relevant root or intermediate certificates. If the backend certificate chains through a private enterprise CA, place that CA in the custom bundle rather than weakening verification globally.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
When verify none is appropriate
verify none disables backend certificate trust checking:
server app1 10.0.0.5:443 ssl verify noneIt can be a deliberate exception for a controlled environment using a self-signed certificate, but it removes protection against an unexpected or impersonating endpoint. Treat it as a scoped operational choice, document why it is needed, and avoid using a global setting such as ssl-server-verify none when only one backend needs an exception.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSNI: why the backend may need the hostname
HTTPS services often host multiple domains on one address. Before an HTTP request is sent, the TLS handshake may need the hostname so the server can select the right certificate and virtual host. That hostname is carried in SNI.
Explicit SNI for portable configurations
In HTTP mode, the portable form is:
server web1 10.0.0.5:443 ssl verify required ca-file /myca.pem sni req.hdr(Host)req.hdr(Host) reads the incoming request’s Host header and sends that value as SNI. This is especially important when the backend’s certificate is issued to a DNS name rather than the private address in the server line.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Automatic SNI in HAProxy 3.3 and newer
HAProxy 3.3 and later automatically derive SNI from the HTTP Host header for server connections unless automatic SNI has been disabled. The same automatic behavior applies to health checks unless no-check-sni-auto is set. Use no-sni-auto when you explicitly need to disable automatic SNI behavior.
Explicit sni req.hdr(Host) remains useful when you want the configuration to state its intent clearly or when maintaining a configuration that must behave consistently across older and newer HAProxy releases. Confirm the running version before relying on 3.3-specific defaults.
Terminating client TLS and re-encrypting to the backend
HAProxy can perform TLS termination on the frontend and start a new TLS session to the backend. A simplified arrangement looks like this:
frontend public_https
mode http
bind :443 ssl crt /etc/haproxy/certs/site.pem
default_backend webservers
backend webservers
mode http
server web1 10.0.0.5:443 ssl verify required ca-file @system-ca sni req.hdr(Host)The browser’s certificate exchange ends at HAProxy. HAProxy then acts as a TLS client to 10.0.0.5:443, validates the server certificate, sends SNI, and forwards the HTTP request over the new encrypted session. This protects the internal hop without requiring the backend to receive the original client TLS session.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
If the frontend does not terminate TLS and instead operates as a TCP pass-through, HAProxy cannot inspect ordinary HTTP headers to create sni req.hdr(Host). In that design, SNI handling and certificate presentation remain part of the end-to-end TLS exchange, so choose the mode according to whether HTTP-layer routing is required.
Backend protocol choices
| Configuration choice | What it provides | Important qualification |
|---|---|---|
ssl with HTTP/1.1 or HTTP/2-style HTTP mode |
Encrypted HAProxy-to-server connection with normal HTTP processing | Use certificate verification and SNI settings appropriate to the backend. |
verify required |
Rejects certificates that do not chain to a trusted CA | Requires a usable CA source such as ca-file or @system-ca. |
verify none |
Allows a TLS connection without trust validation | Use only as an intentional exception, for example with a controlled self-signed certificate. |
Explicit sni req.hdr(Host) |
Passes the request hostname in the TLS ClientHello | Useful for multi-tenant HTTPS services and for versions before automatic Host-derived SNI. |
| Automatic SNI | HAProxy 3.3 and newer derive SNI from Host |
Can be disabled with no-sni-auto; health-check behavior can be disabled with no-check-sni-auto. |
quic4@...:443 ssl |
HTTP/3 over QUIC to a backend | Documented as experimental and limited to HAProxy 3.3 and newer. |
Do not treat the experimental QUIC option as a drop-in replacement for ordinary HTTPS. It is a separate protocol path with stricter version and deployment requirements.
Step-by-step setup checklist
- Confirm the backend listener. Verify that the application server is actually listening for TLS on the address and port used in the
serverline, commonly port 443. - Select the HAProxy mode. Use
mode httpwhen you need HTTP routing, header handling, or Host-based SNI. Use a TCP design only when HTTP inspection is not required. - Add
sslto every HTTPS server. Apply the option individually to each backend server; one clear-text server line does not become encrypted because another line uses TLS. - Choose the trust source. Set
verify required ca-file /path/to/ca.pemfor a private or custom CA, or useca-file @system-cafor the system trust store. - Configure SNI. Add
sni req.hdr(Host)for an explicit, portable setting, or confirm that the installation is HAProxy 3.3 or newer and automatic SNI is enabled. - Account for health checks. Automatic SNI also applies to checks in HAProxy 3.3 and newer unless
no-check-sni-autois configured. Make sure the check reaches the same named HTTPS virtual host as normal traffic. - Handle mutual TLS if required. Add a client certificate with
crtwhen the backend requires HAProxy to authenticate itself, and provide the CA used to validate the backend certificate. - Validate the configuration before reload. Use your normal HAProxy configuration-check procedure, then reload in a controlled way and observe backend health states and TLS errors.
Mutual TLS to an HTTPS backend
Some enterprise services require both sides to authenticate. In that case, HAProxy validates the backend’s certificate while also presenting its own client certificate. The relevant server-line pattern includes ssl, ca-file, sni, and crt:
backend enterprise_service
mode http
server idp 10.0.0.20:443 ssl verify required ca-file /etc/haproxy/enterprise-ca.pem sni req.hdr(Host) crt /etc/haproxy/client.pemThe backend servers must be configured to listen with HTTPS and to trust the certificate authority that issued HAProxy’s client certificate. Keep the client private key protected and use a certificate intended for client authentication.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Troubleshooting common failures
“Certificate verify” or unknown-authority errors
With verify required, HAProxy needs a CA bundle that can build a valid chain from the backend certificate. Check that the configured ca-file exists, is readable, and contains the issuing CA or required intermediate. If the service uses an internal CA, the public system store may not be sufficient.
Hostname or certificate mismatch
A backend can present a certificate for a DNS name while HAProxy connects to a private IP address. Send the expected hostname with sni req.hdr(Host), and ensure the incoming Host value is the name covered by the certificate. Automatic SNI can provide the same result on HAProxy 3.3 and newer.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The backend serves the wrong virtual host
This usually indicates that the backend did not receive the expected SNI name, or that the request Host value is not the service name configured on the backend. Compare the requested hostname with the SNI setting and check whether no-sni-auto has disabled automatic behavior.
Health checks fail while ordinary requests work
Health checks have their own TLS handshake. On HAProxy 3.3 and newer they receive automatic SNI unless no-check-sni-auto is set. If that option is present, configure an explicit check SNI strategy or remove the override so the check reaches the correct HTTPS virtual host.
A self-signed backend will not pass verification
The secure fix is to place the self-signed certificate’s issuing CA, or the appropriate private CA, in a dedicated trust bundle and keep verify required. If operational constraints force verify none, limit it to the affected server and understand that HAProxy is no longer authenticating that endpoint.
QUIC configuration is rejected
Backend HTTP/3 over QUIC uses a separate, experimental feature documented for HAProxy 3.3 and newer. An older release or a non-QUIC backend will not support the quic4@...:443 ssl form; use ordinary HTTPS/TLS unless the entire deployment meets the version and protocol requirements.
Free tools Windows power users keep installed
One-click scans. No signup required.
Security and operations guidance
- Prefer per-server
verify requiredover a global setting that disables validation. - Keep custom CA bundles current when backend certificates or issuing intermediates rotate.
- Use SNI deliberately when several services share one backend address; do not assume the private IP identifies the desired certificate.
- Separate frontend certificate management from backend trust management. Replacing a public-facing certificate does not automatically update the CA bundle used for backend validation.
- Record any
verify none,no-sni-auto, orno-check-sni-autoexception so a later HAProxy upgrade or certificate change does not turn an intentional choice into an unexplained outage.
Bottom line
HAProxy supports HTTPS reverse-proxy backends directly: put ssl on each backend server line, validate certificates with verify required and a CA source, and provide SNI when the backend routes by hostname. HAProxy 3.3 adds automatic Host-derived SNI, while backend HTTP/3 over QUIC remains an experimental, version-specific option.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
