SNIPROXY(8)

NAME
SNIProxy - transparent session based TLS and HTTP proxy

SYNOPSIS
sniproxy [ -c config ] [ -f ] [ -n file-descriptor-limit ] [ -V ] [ -T min-tls-version ] [ -d ]

DESCRIPTION
Proxies incoming HTTP and TLS connections, including HTTP/2 requests, based on the hostname contained in the initial request of the TCP session. This enables HTTPS name-based virtual hosting to separate backend servers without installing the private key on the proxy machine. By default TLS 1.2 (and newer) client hellos are accepted. For security reasons the configuration file must not be readable or executable by group/other users. sniproxy verifies the permissions after opening the file and aborts startup if it detects broader access.

OPTIONS

-c config
    Specify configuration file to use. The default is /etc/sniproxy.conf.

-f  Do not daemonize, and run in foreground.

-n file-descriptor-limit
    Specify the maximum file descriptor resource limit. SNIProxy will attempt to set the maximum file descriptor limit to the value specified.

-V  Print the version of SNIProxy and exit.

-T min-tls-version
    Set the minimum TLS ClientHello version that will be accepted. The value must be one of 1.0, 1.1, 1.2, or 1.3, and controls both the legacy version field and the supported_versions extension. The default is 1.2.

-d  Enable verbose resolver debug logging to stderr and the error log to aid DNS troubleshooting.