I have followed Blogs to configure Varnish on our Magento store with the help of a server person.

Magento version 2.3.5-p1

Varnish version : varnishd (varnish-5.2.1 revision 67e562482)

Server - Ubuntu 18.04 with Apache

Currently, varnish results only show in the terminal when we use the command without HTTPS

curl -s -D - -o /dev/null http://example.com/

This returns "varnish" in result like below

X-Varnish: 100121
Age: 0
Via: 1.1 varnish (Varnish/5.2)
Connection: keep-alive

But when we use URL with HTTPS it not showing varnish

curl -s -D - -o /dev/null https://www.example.com/

Any help will be appreciated.


1 Answer 1


Varnish Cache, the open source version of Varnish, doesn't support TLS natively. However, Varnish does facilitate TLS termination by TLS proxies.

I've written an in-depth tutorial about how we use Hitch at Varnish Software to terminate TLS for Varnish cache: https://www.varnish-software.com/developers/tutorials/terminate-tls-varnish-hitch/.

While the tutorial covers all aspects in detail, I do want to highlight what needs to be done.

Set up a TLS proxy

While there are many HTTP services out there that can perform TLS termination (Apache, HaProxy, Nginx, Pound, ...) we recommend using Hitch.

Hitch is a dedicated TLS proxy that has no HTTP awareness by default. This makes it lightweight and scalable.

Hitch supports the PROXY protocol and can communicate with Varnish over TCP/IP and UDS.

Again, see https://www.varnish-software.com/developers/tutorials/terminate-tls-varnish-hitch/ for more details.

Enable a PROXY-enabled listening port

while port 80 is opened by default or by adding the -a :80 runtime parameter, a dedicated port for terminated HTTPS traffic also needs to be added. Preferable with PROXY protocol support.

Here's an example:

varnishd \
    -a :80 \
    -a localhost:8443,PROXY \
    -a /var/run/varnish.sock,PROXY,user=varnish,group=varnish,mode=660 \    
    -p feature=+http2 \
    -f /etc/varnish/default.vcl \
    -s malloc,2g

This example feature 3 listening ports:

  • Port 80 for plain HTTP traffic
  • Port 8443 for terminated HTTPS traffic using the PROXY protocol
  • A Unix Domain Socket on /var/run/varnish.sock for non-TCP/IP HTTPS traffic, also via the PROXY protocol

While we do recommend using Hitch as the TLS proxy of choice, other products can be used as well. We recommend using the PROXY protocol to ensure that metadata about the original client is not lost along the way.

If your TLS proxy supports Unix Domains sockets, you can communicate over /var/run/varnish.sock. If it doesn't, just connect to localhost on port 8443.

If your TLS proxy doesn't support the PROXY protocol, you can remove the 2 listening addresses and just forward traffic to port 80.

Add TLS awareness in VCL

If TLS is terminated elsewhere, it's important to set the X-Forwarded-Proto: https HTTP request header. This informs other services about the original protocol, rather than the plain HTTP protocol that is used for the communication between Varnish and the web server.

Here's an example where Varnish sets the X-Forwarded-Proto header in case it wasn't set by the TLS proxy.

If the PROXY protocol was used, the vmod_proxy Varnish module can extract the TLS parameters as illustrated below:

vcl 4.1;

import proxy;

backend default {
    .host = "";
    .port = "8080";

sub vcl_recv {
    if(!req.http.X-Forwarded-Proto) {
        if (proxy.is_ssl()) {
            set req.http.X-Forwarded-Proto = "https";
        } else {
            set req.http.X-Forwarded-Proto = "http";

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.