L7 SSL Pass-through Fails Due to Missing Client SNI

Products

• VMware NSX

Issue/Introduction

When using an NSX Load Balancer configured with a L7 HTTP Virtual Server with SSL Pass-through Transport Phase Load Balancer Rules, the following symptoms may occur:

• HTTPS connections fail with client-side SSL/TLS errors.
• Backend server logs (e.g., Apache, Nginx) report errors such as: ERROR: Unsupported or unrecognized SSL message.
• The issue often occurs when accessing the Virtual Server via an IP address instead of a FQDN, or when using legacy clients.
• Configurations migrated from NSX-V that previously worked now fail with the same backend pool.

Environment

VMware NSX

Cause

NSX L7 SSL Pass-through implementation requires a Server Name Indication (SNI) in the client's TLS Hello packet to correctly identify and process the traffic.

If the client request does not include an SNI (which is common when accessing via IP address) or if the SNI does not match configured rules, the Load Balancer does not process the handshake as a pass-through.

If client SSL is configured, it falls back to SSL termination and forward plain-text HTTP to a backend expecting HTTPS, resulting in the Unsupported or unrecognized SSL message error at the server level.
If client SSL is not configured, it falls back to plain-text HTTP LB and returns plain-text HTTP 400 response to a client expecting HTTPS, resulting in client-side SSL/TLS errors.

This behavior differs from legacy NSX-V SSL Pass-through, which acted as a L4 transparent forwarder.

Resolution

To achieve transparent SSL forwarding that does not require SNI inspection, reconfigure the Virtual Server to use the Layer 4 (L4) TCP protocol.

1. Log in to the NSX Manager UI.
2. Navigate to [Networking] > [Load Balancing] > [Virtual Servers].
3. Delete the affected L7 HTTP Virtual Server, or edit the Virtual Server and remove Load Balancer to detach it.
4. Click [ADD VIRTUAL SERVER] and choose L4 TCP.
5. Configure the new Virtual Server as needed.
6. Save the configuration and test the connection.

L4 TCP Virtual Servers do not inspect the SSL/TLS layer and transparently pass all encrypted traffic, including handshakes without SNI, directly to the backend pool members.

Additional Information

Add Layer 4 Virtual Servers