title: Haproxy acl rules for SSL
body: <p>I  need to configure Haproxy for SSL such that if certain keyword match in URL then it should go to non SSL port (8080) and for rest of calls, it should  go to SSL port 8443.</p>
  
  <p>I have assigned 127.0.0.1 for example.com, if URL example.com entered in browser then it pointing localhost in my machine. </p>
  
  <p>In Frontend SSL, acl rules are not working as desired because URL with action 'reporting' or 'account_management' are not referring to backend proxybackend. All traffic going through default_backend SSLappAPI even if URL having action=reporting. </p>
  
  <p>Is acl not  working because i am trying to use non-SSL port  for  SSL traffic or am i having any issue in below haproxy configuration.</p>
  
  <p>Any help will be much appreciated </p>
  
  <p>Example URL: <a href="https://example.com/api/?uid=NrpB1vfSR01KVsxw1YI5H4&amp;action=reporting" rel="nofollow noreferrer">https://example.com/api/?uid=NrpB1vfSR01KVsxw1YI5H4&amp;action=reporting</a></p>
  
  <pre><code>frontend  main *:80
  
      acl is_api url_param(action) -i host_check
      use_backend appAPI      if is_api
      default_backend             appUI
      option             forwardfor
  
  frontend ssl
      mode tcp
      bind *:443
      option tcplog
      acl server_ssl urlp_sub(action) -i reporting
      acl server_ssl urlp_sub(action) -i account_management
      acl server_ssl hdr(host) -i example.com
      acl server_ssl hdr_sub(host) -i example.com
  
      use_backend proxybackend if server_ssl
      default_backend             SSLappAPI
      option             forwardfor
  
  backend appUI
      server      ui-server 127.0.0.1:8080 check maxconn 50#ui &lt;- leave this format to allow for selective script replacement
  
  backend appAPI
      server  api-server 127.0.0.1:8080 check maxconn 750#api &lt;- leave this format to allow for selective script replacement
      timeout http-keep-alive 0s
  
  backend SSLappAPI
      mode tcp
      server  api-server 127.0.0.1:8443 check maxconn 800#ssl &lt;- leave this format to allow for selective script replacement
  
  backend proxybackend
      server proxyserver 127.0.0.1:8080
  </code></pre>