2

I'm trying to add SNI to my client-side program (C/C++) that uses Microsoft SDK's Schannel API for TLS.

I've searched everywhere but could not find any documentation on how Schannel supports SNI extension. I looked up the documentation for AcquireCredentialsHandle(), InitializeSecurityContext() but no success.

So, could anyone please help me with some example code?

Ashish Kakkad
  • 23,586
  • 12
  • 103
  • 136
Anurag S Sharma
  • 400
  • 2
  • 12
  • On client side AFAIK there are no special requirements for using SNI. You just need a SNI capable Windows/SChannel version. – Robert May 11 '15 at 11:36

1 Answers1

0

The SNI is specified as part of the ClientHello, which is generated by InitializeSecurityContext(). Specficially, Schannel uses the 3rd parameter of that function for certificate validation, as well, as SNI; but not all versions of Windows support TLS extensions (which includes SNI).

TLS Extensions were first introduced in Internet Explorer 7 beta 3 on Windows Vista. Plus, even if your operating system supports it, TLS will likely be turned off, by default.

There is a working example on CodeProject that shows SNI from the client and server side.

jveazey
  • 5,398
  • 1
  • 29
  • 44