I'm attempting to setup a new Ubuntu 10.10 server and have SNI available as an optional feature. I'm unfortunately having difficulty getting SNI working with Safari 5 on it. Using phpinfo() as a diagnosis utility, I've found:
- Safari will not send the SSL_TLS_SNI header, and consequently will not receive the proper SSL certificate. This gives a hostname mismatch error message, although Apache still loads the appropriate vhost/DocumentRoot
- Safari will only connect to the server using SSLv3. If I configure Apache's
SSLProtocolto only load TLSv1, Safari gives me a "Safari can’t connect to the server" error message.
Chrome and Firefox both work fine.
I have a separate Gentoo server that works perfectly: Safari sends the SSL_TLS_SNI header fine, and defaults to TLSv1 without prompting. The only major difference I can see between the two distros is that Gentoo is using openssl-1.0.0b, whereas Ubuntu is using 0.9.8o. The mod_ssl and vhosts are otherwise configured essentially the same. My best guess is that older openssl on the server is causing an incompatibility that somehow Firefox/Chrome aren't affected by, but I'd like to confirm my suspicions or see if there's anything I can do about it. Ubuntu 11.04 (natty) and Debian 6 (squeeze) are still stuck on the outdated openssl 0.9.8 series, and I'd like to avoid the sticky mess of managing my own source compiles.
