FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Advanced

Can I specify a Host / SNI in a health check (Virtual domain)? ​

Short answer

Yes. The name written in the Virtual Domain (Host/SNI) field of the profile is sent as the Host header in HTTP and as both the Host header and the TLS SNI in HTTPS; in the TCPS, FTPS, LDAPS and SMTPS types and in the SMTP type with Use STARTTLS on, it is used as the SNI. If an IP address is written in the field, SNI is not sent. If only the Host header is needed, Host can be added to the HTTP Headers field; in WEB-CLI, --virtualDomain is used. The health check does not inherit the SNI setting in the Backend Service.

Problem: The Server Hosts More Than One Site on the Same IP ​

Web servers that host more than one site on the same IP address route the request to the correct site according to the Host header or the TLS SNI. While Virtual Domain is empty, the health check sends the IP address of the server as the Host and does not send SNI; the request falls to the default site, gets the wrong certificate or returns 404, and the server looks unhealthy while it is running.

Solution: 3 Methods ​

Method 1 sets the Host and the SNI together; Method 2 adds only the Host header; Method 3 is the WEB-CLI equivalent of Method 1.

Your situationSuitable method
The server selects the site according to the Host header and/or SNIMethod 1: Virtual Domain (Host/SNI)
Only the Host header is needed (SNI should not be sent)Method 2: HTTP Headers → Host
I update the profile from WEB-CLIMethod 3: WEB-CLI
  • How it works The entered name is sent as the Host header in HTTP, as the Host header and the SNI in HTTPS, and as the SNI in the other TLS types. If Verify Server Certificate is on, the name in the certificate is also compared with this name.
  • Where it is openedLoad Balancer → Profiles → Health Checks → profile → Virtual Domain (Host/SNI)
  • Requirement The domain name of the site
  • vService type All

Step-by-Step Configuration ​

1
Adım 1 Open the Health Checks screen

The Configuration Menu is opened with the TR7 logo at the bottom left; the Load Balancer → Profiles → Health Checks path is followed.

2
Adım 2 Open the form

An existing profile is selected and Edit is clicked, or for a new profile, Add is clicked (How to add?).

3
Adım 3 Enter the name

In a new profile, Name is entered first and the Check Type is selected. The name of the site is entered in the Virtual Domain (Host/SNI) field (e.g. portal.example.com). The field appears at the end of the form in HTTP and HTTPS, among the TLS fields in TCPS, FTPS, LDAPS and SMTPS, and in SMTP only while Use STARTTLS is on.

4
Adım 4 Save the profile

The Edit (Add in a new profile) button is clicked. If an existing profile was edited, the procedure ends here; the change is applied to all the Backend Services that use the profile.

5
Adım 5 Open the Backend Service form

For a new profile, on the Load Balancer → Backend Services screen, the Backend Service is right-clicked and Edit is selected.

6
Adım 6 Select the profile

The profile is selected in the Health Check field.

7
Adım 7 Save

The Edit button is clicked.

Verification ​

1Health statusBackend Services list

The indicator in the Health column of the Backend Services list is checked; in the profile preview, the Virtual Domain (Host/SNI) row shows the entered name (Health status indicator).

ExpectedOK (green)
2Incoming requestServer side

The Host value of the check request is seen in the access log of the server (User-Agent tr7-health-check/2.0).

ExpectedHost: portal.example.com

Method 2: HTTP Headers → Host ​

  • How it works The Host header is added among the custom headers in the profile; SNI is not sent. If Virtual Domain is also filled in, the name in Virtual Domain is used as the Host while HTTP Version is HTTP/1.1, and the name in HTTP Headers while it is HTTP/2.
  • Where it is openedLoad Balancer → Profiles → Health Checks → HTTP/HTTPS profile → HTTP Headers
  • Requirement An HTTP or HTTPS profile
  • vService type All

Step-by-Step Configuration ​

1
Adım 1 Open the profile form

On the Load Balancer → Profiles → Health Checks screen, the profile is selected and Edit is clicked.

2
Adım 2 Add the header

The HTTP Headers switch is set to the Choose position (default Automatic); in the new row, Host is entered as the HTTP Header Name and the name of the site as the HTTP Header Value.

3
Adım 3 Save

The Edit button is clicked.

Verification ​

1Health statusBackend Services list

The indicator in the Health column of the Backend Services list is checked; Host: … appears in the HTTP Headers row of the profile preview.

ExpectedOK (green)

Method 3: WEB-CLI ​

  • How it works Virtual Domain is written with the --virtualDomain field; the field is used in HTTP, HTTPS, TCPS, FTPS, LDAPS, SMTP and SMTPS profiles.
  • Where it is opened WEB-CLI → lb hc add / lb hc update (lb hc · The TLS Fields)
  • Requirement WEB-CLI access; the profile ID (lb hc list)
  • vService type All

Step-by-Step Configuration ​

1
Adım 1 Write the name

In an existing profile:

text
lb hc update id <profile-id> --virtualDomain portal.example.com

In a new HTTPS profile:

text
lb hc add checkType https name portal-saglik --uri /health --virtualDomain portal.example.com

Verification ​

1RecordWEB-CLI

The profile record is displayed.

Commandlb hc show <profile-id>
ExpectedvirtualDomain portal.example.com

Common Mistakes ​

  • Assuming that the SNI setting in the Backend Service is also applied to the health check. The health check uses only the Virtual Domain in the profile; only the client certificate, the CA and the lowest TLS version and the cipher list of the Backend SSL Security Profile are inherited from the Backend Service.
  • Writing an IP in Virtual Domain and expecting SNI. An IP address is not sent as SNI.
  • Adding Host to HTTP Headers and expecting SNI. The header is only at the HTTP layer; for SNI, Virtual Domain is used.

How it is done in the documentation

Related questions