title: Does AWS NLB pass through SNI values when terminating TLS? (Routing via SNI)
body: <p>AWS Network Load Balancers <a href="https://aws.amazon.com/about-aws/whats-new/2019/01/network-load-balancer-now-supports-tls-termination/" rel="noreferrer">support TLS termination</a>.  This means a certificate can be created in AWS Certificate Manager and installed onto a NLB and then TCP connections using TLS encryption will be decrypted at the NLB and then either re-encrypted or passed through to a non-encrypted listener.  Details are here: <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-tls-listener.html" rel="noreferrer">https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-tls-listener.html</a>.</p>
  
  <p>The benefits of using AWS Certificate Manager are that the certificate will be managed and rotated automatically by AWS.  No need to put public-facing certificates on private instances.</p>
  
  <p>I'd like to route TCP connections to the NLB based on the SNI, i.e. connections to the same port and IP can be routed to different targets based on the server name that was requested by the client.  Whilst I can see that <a href="https://aws.amazon.com/about-aws/whats-new/2019/09/elastic-load-balancing-network-load-balancers-now-supports-multiple-tls-certificates-using-server-name-indication/" rel="noreferrer">multiple TLS certificates for a given listener are supported</a> using SNI to determine which certificate to serve up, I don't see how to configure listeners based on SNI.</p>
  
  <p>I have therefore put HAProxy behind a NLB and want to route to different backends using SNI.  I terminate TLS with the client at the NLB, reencrypt the traffic between NLB and HAProxy using a self-signed certificate on HAProxy, then route to the backends using unencyrpted TCP.</p>
  
  <pre><code>(client) --TLS/TCP--&gt; (NLB on port 443) --TLS/TCP--&gt; (AWS target group on port 5000, running HAProxy) --TCP--&gt; backends on different IPs/ports
  </code></pre>
  
  <p>Does AWS NLB pass through the SNI details to the target groups?</p>
  
  <p>If I connect directly to HAProxy (not via NLB) then I can route to the backend of choice by using SNI, but I can't get the SNI routing to work if I connect via the NLB.</p>