Getting IMAPS frontend Layer4 SNI working with a IMAPS backend (port 993)
I have copied the example from https://github.com/mholt/caddy-l4/blob/master/docs/examples/imaps_with_proxy_protocol.md and that works correctly for me (IMAPS --> IMAP).
However, in that example, the IMAP backend is unencrypted.
My IMAP server it listening on port 993 and requires TLS (implicit I believe, no STARTTLS required).
Changing the example to port 993 does not seem to work. On the IMAPS server I see the incoming connection (SYN, SYN+ACK, ACK), but that's it. No continuation. No disconnection. No termination.
The certificate is properly matched though.
The entire log:
```
"debug","ts":"2026-02-18T18:53:56Z","logger":"layer4.handlers.proxy","msg":"dial upstream","remote":"172.22.7.9:57400","upstream":"imaps.somedomain.com:993"}
"debug","ts":"2026-02-18T18:53:56Z","logger":"layer4.handlers.tls","msg":"terminated TLS","remote":"172.22.7.9:57400","server_name":"myimaps.somedomain.com"}
"debug","ts":"2026-02-18T18:53:56Z","logger":"tls.handshake","msg":"matched certificate in cache","remote_ip":"172.22.7.9","remote_port":"57400","subjects":["*.somedomain.com"],"managed":false,"expiration":"2026-05-16T07:34:17Z","hash":"9857e83540137eb4bcaaf8edbdd947ebc4af9d5791f128988b6d91df8c05148b"}
"debug","ts":"2026-02-18T18:53:56Z","logger":"tls.handshake","msg":"default certificate selection results","identifier":"*.somedomain.com","subjects":["*.somedomain.com"],"managed":false,"issuer_key":"","hash":"9857e83540137eb4bcaaf8edbdd947ebc4af9d5791f128988b6d91df8c05148b"}
"debug","ts":"2026-02-18T18:53:56Z","logger":"tls.handshake","msg":"choosing certificate","identifier":"*.somedomain.com","num_choices":1}
"debug","ts":"2026-02-18T18:53:56Z","logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"myimaps.somedomain.com"}
"debug","ts":"2026-02-18T18:53:56Z","logger":"events","msg":"event","name":"tls_get_certificate","id":"41753ade-a707-4bc3-bb80-29c93a7e1791","origin":"tls","data":{"client_hello":{"CipherSuites":[4866,4867,4865,49196,49200,49195,49199,52393,52392,49188,49192,49187,49191,159,158,107,103],"ServerName":"myimaps.somedomain.com","SupportedCurves":[4588,29,23,30,24,25,256,257],"SupportedPoints":"AA==","SignatureSchemes":[2309,2310,2308,1027,1283,1539,2055,2056,2074,2075,2076,2057,2058,2059,2052,2053,2054,1025,1281,1537,771,769,770,1026,1282,1538],"SupportedProtos":null,"SupportedVersions":[772,771],"RemoteAddr":{"IP":"172.22.7.9","Port":57400,"Zone":""},"LocalAddr":{"IP":"172.22.7.250","Port":993,"Zone":""}}}}
"debug","ts":"2026-02-18T18:53:56Z","logger":"layer4","msg":"matching","remote":"172.22.7.9:57400","matcher":"layer4.matchers.tls","matched":true}
"debug","ts":"2026-02-18T18:53:56Z","logger":"layer4.matchers.tls","msg":"matched","remote":"172.22.7.9:57400","server_name":"myimaps.somedomain.com"}
"debug","ts":"2026-02-18T18:53:56Z","logger":"layer4","msg":"prefetched","remote":"172.22.7.9:57400","bytes":1530}
"debug","ts":"2026-02-18T18:53:56Z","logger":"layer4","msg":"matching","remote":"172.22.7.9:57400","error":"consumed all prefetched bytes","matcher":"layer4.matchers.tls","matched":false}
```
Any ideas what could be wrong?
Running caddy on OPNsense 26.1.2.
Configuration:
```
# Global Options
{
log {
output net unixgram//var/run/caddy/log.sock {
}
format json {
time_format rfc3339
}
level DEBUG
}
http_port 8080
https_port 8443
servers {
protocols h1 h2
listener_wrappers {
layer4 {
import /usr/local/etc/caddy/caddy.d/*.layer4listener
}
tls
}
}
layer4 {
import /usr/local/etc/caddy/caddy.d/*.layer4global
tcp/:993 {
@46457e04-ab13-42f8-9efb-9dd76e44d7fd tls sni myimaps.somedomain.com
route @46457e04-ab13-42f8-9efb-9dd76e44d7fd {
tls
proxy tcp/imaps.somedomain.com:993 {
}
}
@5a8d7c1f-d4ab-4347-89c8-319a4a1e7196 tls sni myimap.somedomain.com
route @5a8d7c1f-d4ab-4347-89c8-319a4a1e7196 {
proxy tcp/172.22.7.20:143 {
}
}
}
}
auto_https off
grace_period 10s
skip_install_trust
import /usr/local/etc/caddy/caddy.d/*.global
}
# Reverse Proxy Configuration
# Layer4 default HTTP port
:8080 {
}
# Layer4 default HTTPS port
:8443 {
}
*.somedomain.com {
tls /usr/local/etc/caddy/certificates/699184b13ae29.pem /usr/local/etc/caddy/certificates/699184b13ae29.key {
}
handle {
reverse_proxy https://172.22.7.20 {
transport http {
tls_insecure_skip_verify
}
}
}
}
import /usr/local/etc/caddy/caddy.d/*.conf
```
13 条评论