Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [sni]

Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address

Server Name Indication addresses a common issue where websites with an SSL certificate had to live on separate IPs. This exacerbated the IPv4 shortage, as well as defeated the purpose of virtual hosting, where multiple non-secured sites could share the same IP (note that websites sharing a common certificate can always share an IP).

SNI is based on IETF RFC 4366, which, as part of Transport Layer Security(TLS), allowed the hostname to be sent in the initial stages of the TLS handshake. This allowed websites with different certificates to be hosted on the same IP.

SNI is supported by all major browsers and all major web servers. It requires OpenSSL 0.9.8f or later

Browser Support

  • Mozilla Firefox 2.0 or later
  • Opera 8.0 or later (with TLS 1.1 enabled)
  • Internet Explorer 7.0 or later (on Vista, not XP)
  • Google Chrome
  • Safari 3.2.1 on Mac OS X 10.5.6

Server Support

  • Apache v2.2.12 or later
  • Nginx 0.5.32 or later
  • IIS 8.0 or later
191 questions
2
votes
1 answer

easy_install and pip fail with SSL warnings

I'm looking after some RHEL6 servers and trying to set them up to use an internal PyPi server (proxied by Nexus 3). The problem is that our internal PyPi server is one of several SSL VHosts on the same Nginx server, and Python 2.6 is not SNI…
RCross
  • 469
  • 2
  • 6
  • 19
2
votes
1 answer

Upgrade Windows Server 2008R2 to support SNI

I have a "Windows Server 2008 R2" with the "IIS7.5" and stumble now, when it comes to the topic of SSL: IIS7 does not support SNI. How can SNI be retrofitted or alternatively how can I install "IIS8" (which does support SNI) on WIN2008R2? Here what…
Root
  • 31
  • 1
  • 5
2
votes
1 answer

How can I let my clients use their own SSL on my SaaS

We run a service that lets our clients run their own CMS. Our clients want to use their own SSL Certificate, wether it's self signed, or signed by another company. Our application runs PHP. I was thinking of a reverse proxy technology, but we have…
Felix Lebel
  • 155
  • 1
  • 6
2
votes
1 answer

Can NGINX inspect the TLS request to look for SNI like HAProxy (etc) does?

It seems that, when configuring HAProxy for hostname routing on HTTPS connections, it is crucial to include a tcp-request inspect-delay directive to "give HAProxy a chance to look into the connection". Is there a way to get NGINX to to the same, or…
Morpheu5
  • 259
  • 4
  • 18
2
votes
1 answer

Apache2/Ubuntu 14.04 error.log Hostname provided via SNI and hostname provided via HTTP are different

In my apache2 error.log I see every few minutes an error message “Hostname … provided via SNI and hostname www.google.com.hk provided via HTTP are different”. In the access.log each error can be often be connected to a HEAD-request. We have these…
Eric
  • 21
  • 2
2
votes
1 answer

Social networks and Cloudflare free SSL

Let me expose my setup and problems. Maybe some of you will have ideas for me to test. Setup On Digital Ocean : I have one web server running a web site with NGINX in the front (Ruby on Rails behind, but I think this is not relevant) I have port…
Hugues
  • 23
  • 2
2
votes
1 answer

Does SNI really require TLSv1 (insecure)?

From the Apache 2.4 docs: The first (default) vhost for SSL name-based virtual hosts must include TLSv1 as a permitted protocol, otherwise Apache will not accept the SNI information from the client and it will be as if the client did not support…
nullUser
  • 236
  • 1
  • 7
2
votes
1 answer

Pick SSL cert based on domain name without separate VHosts

I'm working with a WordPress multi-site network that has various top-level domain names. We're currently serving them all up with one virtual host: ServerName example.com ServerAlias * DocumentRoot…
Joshua Dwire
  • 133
  • 8
2
votes
2 answers

Command line to set up SNI on IIS for Windows 2012

I'm trying to complete the automated build script of my web server, which runs Windows 2012 and has two SSL websites, each with its own digital certificate. I am using SNI, which works fine when I set it up manually, but when I use APPCMD to set up…
Ads
  • 21
  • 1
  • 3
2
votes
2 answers

SSL SNI security concerns

Just wondering if SNI is useful in segregating public content from private content. I managed to configure our server to serve /foo for every client but serve /bar only for clients from the intranet, by specifying the host name that is resolved only…
Surranó
  • 33
  • 4
2
votes
1 answer

What does this notice mean "SNI: extension not received from the client", in stunnel log

I am working on multiple domain certificates using stunnel. I have two domains test.int and test1.int and given multiple certificates to each domain and one default certificate. I used sni option of stunnel to provide multiple domain certificates.…
Kaustubh Khare
  • 153
  • 1
  • 9
2
votes
2 answers

Stop default SSL response on Shared IP using SNI

Previously I asked a question here: Single domain SSL presented for all domains on Shared IP about setting up secure and non-secure domains on a single IP. Opinions were mixed, but it appears SNI hold the solution. Unfortunately I cannot get it work…
esryl
  • 135
  • 5
2
votes
0 answers

Debugging incorrect certificate with SNI for some clients

I have a number of domains with SSL certificates served by Haproxy (using Haproxy 1.5's support for SSL). For the most part the correct certificates are being served, but a particular user is incorrectly receiving the default certificate. The…
lukerandall
  • 121
  • 3
2
votes
2 answers

Can't turn off SNI on apache

When I go to: http://web-sniffer.net/ and check the headers of my site (https://www.example.org), I get a status code 200 But when I use the radio button HTTP/1.0 (without Host header), I get a status code 400 (Bad Request). My apache log says…
pmah
2
votes
2 answers

SNI windows xp workaround

Is there some workaround so I can get SNI working for IE on windows xp ?
Dominik Magoń
  • 21
  • 1
1 2 3
…
12 13