如何为多个SSL证书configurationHAProxy

我需要用两个不同的SSL证书来configurationHAProxy

1. www.example.com
2. api.example.com

现在我从serverfault（ 在Haproxy中configuration多个SSL证书 ）的post中学习了如何使用2个证书，但是服务器继续使用两个域中提到的第一个证书。

configuration：

frontend apache-https bind 192.168.56.150:443 ssl crt /certs/crt1.pem crt /certs/cert2.pem reqadd X-Forwarded-Proto:\ https default_backend apache-http backend apache-http redirect scheme https if { hdr(Host) -i www.example.com } !{ ssl_fc } redirect scheme https if { hdr(Host) -i api.example.com } !{ ssl_fc } ... 

如何根据URL告诉HAProxy使用哪个证书？

• 如果不可用（不只是下）
• 是否可以使用多个负载平衡器将stream量redirect到我的应用程序服务器？
• 负载均衡的IIS。 我应该使用NLB，还是基于linux的反向代理或其他？
• 在后端启动时，HAProxy使用NOSRV进行响应
• HAProxy SSL农场选项

完整configuration：

 global log /dev/log local0 log /dev/log local1 notice chroot /var/lib/haproxy stats socket /run/haproxy/admin.sock mode 660 level admin stats timeout 30s user haproxy group haproxy daemon # Default SSL material locations ca-base /etc/ssl/certs crt-base /etc/ssl/private ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS ssl-default-bind-options no-sslv3 tune.ssl.default-dh-param 2048 // better with 2048 but more processor intensive defaults log global mode http option tcplog option dontlognull timeout connect 5000 timeout client 50000 timeout server 50000 frontend apache-http bind 0.0.0.0:80 mode http option http-server-close # needed for forwardfor option forwardfor # forward IP Address of client reqadd X-Forwarded-Proto:\ http default_backend apache-http stats enable frontend apache-https bind 0.0.0.0:443 ssl crt cer1.pem cert2.pem reqadd X-Forwarded-Proto:\ https default_backend apache-http backend apache-http redirect scheme https if { hdr(Host) -i db.example.com } !{ ssl_fc } redirect scheme https if { hdr(Host) -i api2.example.com } !{ ssl_fc } balance roundrobin cookie SERVERID insert indirect nocache server www-1 10.0.0.101:80 cookie S1 check server www-2 10.0.0.102:80 cookie S2 check server www-3 10.0.0.103:80 cookie S3 check 

 frontend http-in bind *:80 bind *:443 ssl crt cert1.pem crt cert2.pem mode http acl common_dst hdr(Host) -m str place1.com place2.com use_backend be_common if common_dst backend be_common # nothing special here.