Enforce strict-sni instead of default certificate fallback

[Copilot]

What this PR does

Adds strict-sni to the global ssl-default-bind-options in templates/haproxy.cfg.j2. HAProxy now rejects TLS handshakes whose SNI matches no configured certificate instead of silently serving a default certificate. Applies to every SSL frontend (ingress, ingress-per-unit, haproxy-route, gRPC, TCP terminate).

reference docs: https://www.haproxy.com/documentation/haproxy-configuration-manual/latest/#5.1-strict-sni

This option is also available
on global statement "ssl-default-bind-options"

ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets strict-sni

Why we need it

Falling back to a default certificate masks misconfiguration and serves the wrong cert for unknown hostnames. strict-sni fails the connection instead, surfacing the mismatch.

Review focus: clients that connect without SNI (or with an unmatched SNI) will now be rejected at the TLS layer. Set globally rather than per-bind to cover all frontends with one option.

Potential breaking change: existing non-SNI TLS clients targeting these frontends will start failing the handshake.

Checklist

• I followed the contributing guide
• I added or updated the documentation (if applicable)
• I updated docs/changelog.md with user-relevant changes
• I added a change artifact for user-relevant changes in docs/release-notes/artifacts. If no change artifact is necessary, I tagged the PR with the label no-release-note.
• I used AI to assist with preparing this PR
• I added or updated tests as needed (unit and integration)
• If integration test modules are used: I updated the workflow configuration
  (e.g., in .github/workflows/integration_tests.yaml, ensure the modules list is correct)
• If this PR involves a Grafana dashboard: I added a screenshot of the dashboard
• If this PR involves Terraform: terraform fmt passes and tflint reports no errors

• Fixes Don't fall back to a default certificate #610

[swetha1654]

Would this be a breaking change?

[Copilot]

Pull request overview

This PR tightens TLS behavior for all SSL frontends generated by the charm by enabling HAProxy’s strict-sni globally, preventing fallback to a default certificate when SNI is missing or does not match a configured certificate.

Changes:

• Enabled strict-sni in global ssl-default-bind-options in the HAProxy config template.
• Added a release-notes change artifact documenting the behavior change.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
haproxy-operator/templates/haproxy.cfg.j2	Adds strict-sni to global bind SSL options to enforce SNI/cert matching.
docs/release-notes/artifacts/pr0621.yaml	Release note entry describing the new strict SNI TLS behavior.

Suppressed comments (1)

docs/release-notes/artifacts/pr0621.yaml:10

• strict-sni also rejects TLS handshakes that do not include SNI at all, not just those with an unmatched SNI. The release note currently omits the no-SNI behavior, which is part of the breaking change users need to be aware of.

    description: >
      Added `strict-sni` to the global `ssl-default-bind-options` so HAProxy
      rejects TLS connections whose SNI does not match any configured
      certificate instead of falling back to a default certificate.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Thanhphan1147]

Moving this to draft to evaluate backwards compatibility