title: Nginx Load Balancing HTTPs cluster
body: <p>I watn to use Nginx as load balancer for Consul cluster. The Consul cluster is reachable only with TLS.</p>
  <p>Here I've tried to reverse proxy a single Consul server to check if the TLS certificates are working</p>
  <pre><code>server {
      listen 80;
      listen [::]:80;
      
      location  /consul/ {
  
          resolver 127.0.0.1;
  
          proxy_pass https://core-consul-server-1-dev.company.io:8500;
  
          sub_filter_types text/css application/javascript;
          sub_filter_once off;
          sub_filter /v1/ /consul_v1/;
  
          proxy_ssl_certificate      /etc/nginx/certs/agent.crt;
          proxy_ssl_certificate_key  /etc/nginx/certs/agent.key;
          proxy_ssl_trusted_certificate  /etc/nginx/certs/ca.crt;
          proxy_ssl_verify        on;
          proxy_ssl_verify_depth  4;      
  
      }
  }
  </code></pre>
  <p>this configuration working fine and I can call it with</p>
  <pre class="lang-sh prettyprint-override"><code>curl http://core-proxy-server-1-dev.company.io/consul/consul_v1/agent/members
  </code></pre>
  <p>Now I've tried to do an upstream like this:</p>
  <pre><code>upstream consul {
      server core-consul-server-1-dev.company.io:8500;
      server core-consul-server-2-dev.company.io:8500;
  }
  
  server {
  
      listen 80;
      listen [::]:80;
    
      
      location  /consul/ {
  
          resolver 127.0.0.1;
  
          proxy_pass https://consul;
          sub_filter_types text/css application/javascript;
          sub_filter_once off;
          sub_filter /v1/ /consul_v1/;
          
          proxy_ssl_certificate      /etc/nginx/certs/agent.crt;
          proxy_ssl_certificate_key  /etc/nginx/certs/agent.key;
          proxy_ssl_trusted_certificate  /etc/nginx/certs/ca.crt;
          proxy_ssl_verify        on;
          proxy_ssl_verify_depth  4;      
  
      } 
  }
  </code></pre>
  <p>when calling the same curl command as before, I get the following error:</p>
  <pre><code>2021/04/20 08:38:59 [debug] 3364#3364: *1 X509_check_host(): no match
  2021/04/20 08:38:59 [error] 3364#3364: *1 upstream SSL certificate does not match &quot;consul&quot; while SSL handshaking to upstream, client: 10.10.xx.xxx, server: , request: &quot;GET /consul/consul_v1/agent/members HTTP/1.1&quot;, upstream: &quot;https://10.10.yy.yyy:8500/consul/consul_v1/agent/members&quot;, host: &quot;core-proxy-server-1-dev.company.io&quot;
  </code></pre>
  <p>Then I've tried like this:</p>
  <pre><code>upstream consul_1 {
      server core-consul-server-1-dev.company.io:8500;
  }
  
  upstream consul_2 {
      server core-consul-server-2-dev.company.io:8500;
  }
  
  map $http_host $backend {
      core-consul-server-1-dev.company.io       consul_1;
      core-consul-server-2-dev.company.io       consul_2;
  
  }
  
  server {
  
      listen 80;
      listen [::]:80;
    
      
      location  /consul/ {
  
          resolver 127.0.0.1;
  
          proxy_pass https://$backend;
          sub_filter_types text/css application/javascript;
          sub_filter_once off;
          sub_filter /v1/ /consul_v1/;
          
          proxy_ssl_certificate      /etc/nginx/certs/agent.crt;
          proxy_ssl_certificate_key  /etc/nginx/certs/agent.key;
          proxy_ssl_trusted_certificate  /etc/nginx/certs/ca.crt;
          proxy_ssl_verify        on;
          proxy_ssl_verify_depth  4;      
  
      }
  
  }
  </code></pre>
  <p>but also no luck;</p>
  <pre><code>2021/04/20 08:45:05 [error] 3588#3588: *1 invalid URL prefix in &quot;https://&quot;, client: 10.10.xx.xxx, server: , request: &quot;GET /consul/consul_v1/agent/members HTTP/1.1&quot;, host: &quot;core-proxy-server-1-dev.company.io&quot;
  
  </code></pre>
  <p>any ideas? can someone please help me with one?</p>