Reference
show ssl sni
On this page
Available since
- HAProxy 3.2
- HAProxy Enterprise 2.9r1
Display the names of the Server Name Indication (SNI) loaded by OpenSSL during initialization.
Description Jump to heading
The show ssl sni command dumps every SNI configured for all frontends, or, when the -f <frontend> option is used, only for the specified frontend.
The command shows what SNI are offered for a frontend and allows you to determine if a SNI is defined multiple times by multiple certificates for the same frontend.
To dump only expired certificates, use the -A option. Expiration is determined by the NotAfter date.
Columns are separated by a single tab (\t) to permit easy parsing.
| Column | Description |
|---|---|
Frontend/Bind |
The frontend name followed by the bind line position in the configuration (frontend/file:linenum). |
SNI |
The SNI. It can be either a CN, a SAN, or a filter from a crt-list. The default certificates of a bind line, (which are either declared explicitly by default-crt or implicitly the first certificate of a bind line when no strict-sni is used) shows the asterisk (*) character in the SNI column. |
Negative Filter |
The list of negative filters matching a wildcard. Shows all negative filters that are on the same crt-list line. A dash character (-) is displayed if there are none. |
Type |
The encryption algorithm type, one of rsa, ecdsa or dsa. |
Filename |
Can be either a filename from the configuration or an alias declared in a crt-store. |
NotAfter and NotBefore |
These columns are directly extracted from the X509 leaf certificate. |
Examples Jump to heading
Show all SNI for all frontends:
nix
nix
outputtext
outputtext
Show expired SNI for all frontends (assuming the current date is before Feb 01 2025):
nix
nix
outputtext
outputtext
Do you have any suggestions on how we can improve the content of this page?