Okay so um, I realize I am nitpicking and for my original problem of not getting spam/garbage in my logs, I have other options. I don’t really want to implement that. With that out of the way, here are some observations.
I am talking about just normal HTTP requests, not TLS client auth/mTLS.
I have two hosts for my test, auth.ishanjain.me & jellyfin.ishanjain.me.
With the included code at the bottom, here is what I see
- with
strict_sni_host=true
→ Response 1 from auth.ishanjain.me: 200 OK
→ Response 2 from jellyfin.ishanjain.me: 421 Misdirected Request
- with
strict_sni_host=false
→ Response 1 from auth.ishanjain.me: 200 OK
→ Response 2 from jellyfin.ishanjain.me: 302 Found
- after adding the line
req2.Host = "example.com" before doing client.Do(req2) where example.com is not configured in my caddy instance and strict_sni_host=true
→ Response 1 from auth.ishanjain.me: 200 OK
→ Response 2 from jellyfin.ishanjain.me: 421 Misdirected Request
- after adding the line
req2.Host = "example.com" before doing client.Do(req2) where example.com is not configured in my caddy instance and strict_sni_host=false
→ Response 1 from auth.ishanjain.me: 200 OK
→ Response 2 from jellyfin.ishanjain.me: 404 Not Found
(In the last 2 examples, the response 2 says jellyfin… but the hostname was changed to example.com)
So to summarize,
strict_sni_host=true is really strict, it allows the exact match and no other hostname.strict_sni_host=false completely disables the feature and it’ll allow anything at all! In my example, example.com was not configured on the proxy so I got 404 but if I add a config for example.com, It’ll hit that subroute.- What I am asking for is a option in the middle called
loose. It should allow any hostname configured in the proxy and every thing else should be served with a 421.
I want to keep strict_sni_host=true because I like it but the 421s are a problem with wildcard certificates and I see a large number of them being served to people who use my homelab. 
And I see these frequently because I run authelia at auth.domain.com for services on the same domain so people open service.domain.com, redirected to auth.domain.com but instead of seeing the auth page, they get 421!
The program for testing:-
package main
import (
"crypto/tls"
"fmt"
"log"
"net/http"
"net/http/httputil"
)
func main() {
authHost := "auth.ishanjain.me"
jfHost := "jellyfin.ishanjain.me"
tlsConfig := &tls.Config{
ServerName: authHost,
}
conn, err := tls.Dial("tcp", authHost + ":443", tlsConfig)
if err != nil {
log.Fatalf("Failed to dial and establish TLS connection: %v", err)
}
defer conn.Close()
clientConn := httputil.NewClientConn(conn, nil)
defer clientConn.Close()
req1, err := http.NewRequest("GET", "https://"+authHost, nil)
if err != nil {
log.Fatalf("Failed to create first request: %v", err)
}
resp1, err := clientConn.Do(req1)
if err != nil {
log.Fatalf("Failed to do first request: %v", err)
}
defer resp1.Body.Close()
fmt.Printf("--> Response 1 from %s: %s\n", authHost, resp1.Status)
req2, err := http.NewRequest("GET", "https://"+jfHost, nil)
if err != nil {
log.Fatalf("Failed to create second request: %v", err)
}
resp2, err := clientConn.Do(req2)
if err != nil {
log.Fatalf("Failed to do second request: %v", err)
}
defer resp2.Body.Close()
fmt.Printf("--> Response 2 from %s: %s\n", jfHost, resp2.Status)
}