When querying Sparkfun's CDN url using OpenSSL with the following command:
openssl s_client -showcerts -connect dlnmh9ip6v2uc.cloudfront.net:443
The common name returned in the certificate is
*.sparkfun.com, which fails to verify, but if you load the host in Chrome, the common name shown is
What is going on here?
This is causing a problem because the environment I am in proxies SSL via Squid SSL_Bump, which generates a certificate signed by my locally trusted CA for the domain. This works for all domains but the above, as the CN does not match as the new cert is generated using OpenSSL.
EDIT - I have verified the same occurs with OpenSSL on a server in a remote data centre that has a direct connection to the internet with no proxies or filtering involved.
EDIT - The issue is due to SNI, as accepted, but to fill out the information as to why it causes a problem with Squid and SSL_Bump:
This project will not support forwarding of SSL Server Name Indication (SNI) information to the origin server and will make such support a little more difficult. However, SNI forwarding has its own serious challenges (beyond the scope of this document) that far outweigh the added forwarding difficulties.