From the Apache 2.4 docs:
The first (default) vhost for SSL name-based virtual hosts must include TLSv1 as a permitted protocol, otherwise Apache will not accept the SNI information from the client and it will be as if the client did not support SNI at all.
I want to have multiple TLS enabled sites on my server, each giving a different certificate. For security reasons, I only allow TLSv1.1 and TLSv1.2. Is there a secure way to turn on SNI?
A snippet from my config:
<VirtualHost *:80>
ServerName www.example.com
Redirect permanent / https://www.example.com/
</VirtualHost>
<VirtualHost *:443>
ServerName www.example.com
DocumentRoot /var/www/example.com
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3 -TLSv1
[other SSL options]
</VirtualHost>
<VirtualHost *:80>
ServerName www.example.org
Redirect permanent / https://www.example.org/
</VirtualHost>
<VirtualHost *:443>
ServerName www.example.org
DocumentRoot /var/www/example.org
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3 -TLSv1
[other SSL options]
</VirtualHost>