[Feature Request] Allow customization of TLS server name (SNI) in ServersTransport #1647

New Issue

MrUnknownDE · 2026-04-05T19:38:17+02:00

MrUnknownDE commented

2026-04-05 19:38:17 +02:00

Originally created by @4nx on 4/2/2025

Background:
When using Pangolin in setups involving multiple reverse proxies (such as Traefik in a two-tier reverse proxy configuration), the server name used during the TLS handshake (SNI) to backend servers is currently not configurable and not set. As reported in Issue #207, this limitation causes TLS handshake failures because the backend reverse proxy does not receive the correct server name via SNI and thus cannot select the appropriate certificate.

Proposed Enhancement:
Implement an option within Pangolin's configuration to explicitly specify the TLS server name used during the connection establishment with backend services (ServersTransport). This would allow users to define a custom SNI value, ensuring proper TLS handshakes in scenarios involving multiple reverse proxies.

Benefits:

Resolves TLS handshake failures by ensuring correct SNI is passed to backend services.
Enables smoother integration with multi-layer reverse proxy setups.
Provides greater flexibility and robustness for advanced network configurations.

Related Issues:
Directly addresses problems discussed in Issue #207, specifically regarding TLS handshake errors caused by incorrect or missing SNI information.

*Originally created by @4nx on 4/2/2025* **Background:** When using Pangolin in setups involving multiple reverse proxies (such as Traefik in a two-tier reverse proxy configuration), the server name used during the TLS handshake (SNI) to backend servers is currently not configurable and not set. As reported in [Issue #207](https://github.com/fosrl/pangolin/issues/207), this limitation causes TLS handshake failures because the backend reverse proxy does not receive the correct server name via SNI and thus cannot select the appropriate certificate. **Proposed Enhancement:** Implement an option within Pangolin's configuration to explicitly specify the TLS server name used during the connection establishment with backend services (ServersTransport). This would allow users to define a custom SNI value, ensuring proper TLS handshakes in scenarios involving multiple reverse proxies. **Benefits:** * Resolves TLS handshake failures by ensuring correct SNI is passed to backend services. * Enables smoother integration with multi-layer reverse proxy setups. * Provides greater flexibility and robustness for advanced network configurations. **Related Issues:** Directly addresses problems discussed in [Issue #207](https://github.com/fosrl/pangolin/issues/207), specifically regarding TLS handshake errors caused by incorrect or missing SNI information.

MrUnknownDE closed this issue

2026-04-05 19:38:17 +02:00

MrUnknownDE added the reverse proxy good first issue new feature reverse proxy reverse proxy reverse proxy reverse proxy reverse proxy good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue new feature new feature labels 2026-04-05 19:38:19 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue good first issue new feature new feature new feature reverse proxy reverse proxy reverse proxy reverse proxy reverse proxy reverse proxy

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1647