By now I've not used SNI with nginx yet. But as IP address pools are quite filled and commercial XP support is about to cease (finally) I'm thinking about converting a few sites to SNI.
I'm aware of the general limitations and pitfalls that might come along with SNI (XP issue, very old browsers). But beyond that is there anything I should be aware of?
Like - nginx related pitfalls when using SNI - issues/bugs with recent (notable!) browsers
If your version of nginx shows TLS SNI support when you do nginx -V then you're ready to go.
If you want to run your server without regard to the IP address, then don't use an IP address in the SSL web server's listen directives to use SNI for that virtual host.
For instance, change:
listen 198.51.100.206:443 ssl;
to:
listen 443 ssl;
Even if you do use an IP address, SNI will be used anyway, for all servers which are listening on the same IP address.
Actually, it's not client software you should be worried about. Most people run a decent browser nowadays and mobile devices are basically safe.
When we tried running nginx with SNI, we discovered that some service providers were really falling behind. In one case, a certain online payments provider would just drop HTTP calls towards us because their software was based on a really old (pre-SNI support) Perl library. Users seeing their credit cards getting charged with no result were not amused. The provider's response was surprise - they had no clue they had this problem. Sadly, they sai they needed months to fix this.
I wish this was just one provider, but no. We ended up going back to separate IPs for each domain.
Lesson learned: check all software that is going to talk to your nginx.
