title: haproxy sni ssl_fc_has_sni always 0
body: <p>I am trying to create an SNI based frontend/backend setup in HAProxy.  It seems that ssl_fc_has_sni is always evaluating to 0 in my log and I haven't been able to figure out why. </p>
  
  <p>This is a simplified version of the config I've been testing with:</p>
  
  <pre><code>global
    user haproxy
    group haproxy
    daemon
    log /dev/log local0
  
  defaults
    timeout connect 5s
    timeout client 30s
    timeout server 30s
    timeout tunnel 1h
    log-format frontend:%f\ %b/%s\ client_ip:%Ci\ client_port:%Cp\ SSL_version:%sslv\ SSL_cypher:%sslc\ SNI:%[ssl_fc_has_sni]\ %ts
  
  frontend public_ssl
    bind :443
    log global
    tcp-request inspect-delay 5s
    tcp-request content accept if { req_ssl_hello_type 1 }
  
    use_backend be_sni if { ssl_fc_has_sni }
    default_backend be_no_sni
  
  backend be_sni
    server fe_sni 127.0.0.1:10444 weight 1 send-proxy
  
  frontend fe_sni
    #terminate with a cert that matches the sni host
    bind 127.0.0.1:10444 ssl crt /mycertdir/certs accept-proxy no-sslv3
    default_backend be_default
  
  frontend fe_no_sni
    #terminate with a generic cert
    bind 127.0.0.1:10443 ssl crt /myothercertdir/default_pub_keys.pem accept-proxy no-sslv3
    default_backend be_default
  
  # backend for when sni does not exist, or ssl term needs to happen on the edge
  backend be_no_sni
    server fe_no_sni 127.0.0.1:10443 weight 1 send-proxy
  
  backend be_default
    mode http
    option forwardfor
    option http-pretend-keepalive
    server the_backend 127.0.0.1:8080
  </code></pre>
  
  <p>Other items of note:</p>
  
  <ul>
  <li><code>haproxy -vv</code> shows OpenSSL library supports SNI : yes    </li>
  <li>I am running haproxy version 1.5.9 on fedora 20 through vagrant</li>
  <li>the log always shows SNI:0 <code>haproxy[17807]: frontend:public_ssl be_no_sni/fe_no_sni client_ip:&lt;ip&gt; client_port:42285 SSL_version:- SSL_cypher:- SNI:0 --</code></li>
  <li>I'm testing with <code>openssl s_client -servername www.example.com -connect &lt;ip&gt;:443</code>.</li>
  </ul>
  
  <p>I feel like I'm missing something obvious since there is no ssl version, cypher, or sni.</p>