How do I setup SNI?

SNI is only supported in the v2 configuration/API.

The current implementation has the requirement that the filters in every FilterChain must be identical. In a future release, this requirement will be relaxed so that SNI can be used to choose between completely different filter chains. Domain name matching can still be used within the HTTP connection manager to choose different routes. This is by far the most common use case for SNI.

The following is a YAML example of the above requirement.

  1. address:
  2.   socket_address: { address: 127.0.0.1, port_value: 1234 }
  3. filter_chains:
  4. - filter_chain_match:
  5.     sni_domains: "example.com"
  6.   tls_context:
  7.     common_tls_context:
  8.       tls_certificates:
  9.         - certificate_chain: { filename: "example_com_cert.pem" }
  10.           private_key: { filename: "example_com_key.pem" }
  11.   filters:
  12.   - name: envoy.http_connection_manager
  13.     config:
  14.       route_config:
  15.         virtual_hosts:
  16.         - routes:
  17.           - match: { prefix: "/" }
  18.             route: { cluster: service_foo }
  19. - filter_chain_match:
  20.     sni_domains: "www.example.com"
  21.   tls_context:
  22.     common_tls_context:
  23.       tls_certificates:
  24.         - certificate_chain: { filename: "www_example_com_cert.pem" }
  25.           private_key: { filename: "www_example_com_key.pem" }
  26.   filters:
  27.   - name: envoy.http_connection_manager
  28.     config:
  29.       route_config:
  30.         virtual_hosts:
  31.         - routes:
  32.           - match: { prefix: "/" }
  33.             route: { cluster: service_foo }