Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address

learn more… | top users | synonyms

0
votes
0answers
25 views

How to enable SNI with Apache in Redhat 5.11

I am on redhat 5.11. I want to enable SNI with apache, but I only have Apache/2.2.3 + OpenSSL 0.9.8e-fips-rhel5. I am in a very similar situation like this ...
1
vote
0answers
33 views

Social networks and Cloudflare free SSL

Let me expose my setup and problems. Maybe some of you will have ideas for me to test. Setup On Digital Ocean : I have one web server running a web site with NGINX in the front (Ruby on Rails ...
0
votes
0answers
33 views

Does SNI really require TLSv1 (insecure)?

From the Apache 2.4 docs: The first (default) vhost for SSL name-based virtual hosts must include TLSv1 as a permitted protocol, otherwise Apache will not accept the SNI information from the ...
2
votes
1answer
69 views

Nginx: SNI doesn't work for server_name with multiple arguments

With this Nginx config: server { listen 443 ssl; server_name www.x.nl x.nl; ssl_certificate /etc/nginx/ssl/x.nl.crtkeyca; ssl_certificate_key /etc/nginx/ssl/x.nl.crtkeyca; ...
2
votes
1answer
33 views

Pick SSL cert based on domain name without separate VHosts

I'm working with a WordPress multi-site network that has various top-level domain names. We're currently serving them all up with one virtual host: <VirtualHost *:80> ServerName ...
0
votes
1answer
102 views

SSL with Virtual Hosts Using SNI

I am using RHEL 6, httpd-2.4.10, openssl-1.0.2a and I have setup SNI as explained in http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI Everytime I restart apache I get following message: ...
1
vote
1answer
85 views

SNI (SSL) support on Facebook built-in browser on Android [closed]

This issue in the Android bug tracker seems to suggest that SNI has been part of the Android OS now for some time so I'm surprised to find that visiting our CloudFlare Flexible-SSL enabled site throws ...
2
votes
2answers
64 views

Command line to set up SNI on IIS for Windows 2012

I'm trying to complete the automated build script of my web server, which runs Windows 2012 and has two SSL websites, each with its own digital certificate. I am using SNI, which works fine when I ...
0
votes
0answers
71 views

How to reverse proxy with SSL using apache

I have two SSL enabled servers. I want to be able to visit https://server1.com/foo/bar and have server1 reverse proxy the request over to https://server2.com/bar. Server2 has several https virtual ...
0
votes
3answers
53 views

Server setup for SSL for sending and receiving emails?

I managed to setup one physical server using postfix, dovecot with mysql server. I do plan to use virtual domains and users. Current setup to send and receive emails. SENDING smtp.example.com ...
3
votes
1answer
167 views

Cannot disable SNI on Windows Server 2012

I have two different 'families' of related sites, each with their own UCC certificate on the same server. I'm hosting them on the same IIS server, using one IP address for each family. Both UCC ...
0
votes
1answer
43 views

Dedicated server issues with SSL and IPs, content showing on wrong site [closed]

We have a number of sites on this dedicated server. Pages from one site are showing up on another site. Example: clientsite1.com (right site, no SSL installed) clientsite2.com (forwards to SSL, ...
2
votes
2answers
363 views

SSL SNI security concerns

Just wondering if SNI is useful in segregating public content from private content. I managed to configure our server to serve /foo for every client but serve /bar only for clients from the intranet, ...
0
votes
0answers
129 views

How to configure HAProxy to use SNI for SSL enabled backends?

I have several backend web servers that have multiple vhosts and I want to use HAProxy in front of them. It doesn't appear that HAProxy is sending the hostname in the TLS connection to the backend ...
0
votes
0answers
68 views

Server returning 404 for only Baiduspider

I recently updated my website to enforce HTTPS for all requests. Everything appears to be working well after this change but Baidu's web crawler (Baiduspider) is receiving a 404 for all requests. ...
1
vote
0answers
63 views

Do modern web browsers always send the web server's hostname in the SNI extension header?

When a web browser that supports Server Name Indication (SNI) connects to an HTTPS site, does it ALWAYS send the hostname in the SNI field? That is, there is no way for a web browser to know if the ...
0
votes
2answers
111 views

SNI for multi tenant load balancing in 2015

We're a multi-tenant service and terminate our SSL at our load balancers (HAProxy + Apache for SSL termination), this has caused growing pains due to dedicated IP requirements. But times have changed ...
2
votes
1answer
150 views

How to serve multiple SSL certificates for the default virtual host on NGINX?

I have a static app on Amazon S3 that is served through a NGINX proxy. The purpose I use a proxy is to allow users to point their domains to my Amazon EC2 instance (via CNAME record pointing to ...
0
votes
1answer
71 views

Browser gets two different SSL certificates instead of one (IE only) [closed]

It seems the problem appears only for IE11 (Win) users, for other OS and browsers HTTPS connection works fine. IE11 firstly gets outdated SSL certificate warning You ignore warning, proceed anyway ...
0
votes
0answers
273 views

ACL at HAProxy shows NOSRV

I have 3 backends in HAProxy 1.5.10: "WEB", "API", and "SSL" for web and api. For SSL termination I'm using ACL with SNI. Here is my config: frontend ssl mode tcp bind 0.0.0.0:443 ssl crt ...
2
votes
1answer
2k views

HAProxy with SNI and different SSL Settings

I have HAProxy for my two sites, one of them public and one private. www.mysite.com private.mysite.com Atm, I'm using haproxy like this: frontend mysite_https bind *.443 ssl crt /etc/mycert.pem ...
1
vote
1answer
292 views

curl 7.21 does not correctly call a host with a host header on https

We found out that calling a host like following using curl 7.21 or 7.24 does produce an error in the apache config (we have multiple SSL Vhosts!). Whereas the same command runs smooth with curl 7.34 ...
3
votes
1answer
417 views

Can TLSv1 / SNI be blocked by the network? (routers, firewalls, etc)

Our web site serves static content through a content delivery network (AWS CloudFront) which is configured to respond to a number of CNAMEs and use our SSL wildcard certificate for these hostnames. ...
1
vote
1answer
241 views

apache always serves first named vhost regardless of SNI setting

Apache is always serving the first named vhost regardless of SNI setting. I'm unsure what is causing this. I no longer get the message Init: Name-based SSL virtual hosts only work for clients with ...
5
votes
1answer
2k views

Can a Reverse Proxy use SNI with SSL pass through?

I need to serve several applications over https using one external ip address. The ssl certificates should not be managed on the reverse proxy. They are installed on the application servers. Can a ...
0
votes
0answers
733 views

Apache mod_proxy with HTTPS without key material (using SNI)

I would like to have an Apache 2.4 proxy which redirects port 80 and 443 requests to different machines in the local network, depending on the host name. I used mod_proxy and it works fine with port ...
0
votes
3answers
338 views

Strict SNI matching for Apache

I have multiple SSL vhosts and non-SSL vhosts served from a single server. If one of the non-ssl vhosts is accessed using "https", the first SSL directive is used. Is there some setting to make it so ...
3
votes
1answer
1k views

SNI error over SSL on some Android devices

I am getting an SNI error: Hostname X provided via SNI, but no hostname provided in HTTP request On some Android phones when making SSL requests to my domain. This is despite ensuring that the Host ...
1
vote
1answer
210 views

How to use SSL Name Based Vhosts without SNI

I need to host a handful of web applications over SSL using name based virtual hosting. Apache documentation indicates this is possible (https://wiki.apache.org/httpd/NameBasedSSLVHosts) if all sites ...
0
votes
2answers
466 views

Apache SNI, 2 domains, 2 certs, resolves to same document root

I am currently following the following guide: https://www.digitalocean.com/community/articles/how-to-set-up-multiple-ssl-certificates-on-one-ip-with-apache-on-ubuntu-12-04 Setup so far has been ...
0
votes
1answer
189 views

Understanding XP users accessing a UCC certificate on IIS8

I have a single IIS website which hosts 3 different websites all using the same UCC SSL certificate. (The code of my site examines the host header itself to decide which variation of the site to ...
2
votes
1answer
172 views

What does this notice mean “SNI: extension not received from the client”, in stunnel log

I am working on multiple domain certificates using stunnel. I have two domains test.int and test1.int and given multiple certificates to each domain and one default certificate. I used sni option of ...
-3
votes
1answer
181 views

How do I send different SSLCertificateFile based on SSL_TLS_SNI environment variable? [closed]

Idea is to run a wildcard cert off an internal CA for *.domain.com, while public-facing domain.com site is validated by a world recognized CA. Application serving requests is the same though, so I'd ...
6
votes
2answers
3k views

using nginx with SNI

By now I've not used SNI with nginx yet. But as IP address pools are quite filled and commercial XP support is about to cease (finally) I'm thinking about converting a few sites to SNI. I'm aware of ...
8
votes
3answers
490 views

Upgrade HTTP connection to SSL/TLS

I currently have a server which automatically redirects all HTTP requests to the equivalent HTTPS site. The problem is that is seems like some browsers do not accept the SSL certificate (StartSSL.com) ...
3
votes
1answer
676 views

Using SNI on Windows Server 2012 R2 not working

I am trying to get both my sites running with their seperate certificates on a Windows Server 2012 R2. Should this not be possible? On the last added site www.c1get.net I get the certificate from ...
8
votes
3answers
1k views

SNI and wildcard SSL certificates on the same server with IIS

I'd like to host a website that should listen to subdomains (e.g. sub.domain.com) together with multiple websites that live just under a second-level domain (e.g. domain2.com, domain3.com) with IIS ...
1
vote
2answers
56 views

Correct configuration for SSL over 3 domains on same IP in nginx

I have been working on this for several hours now, to no fruition. Right now I have three domains, for example domain1.com, domain2.org, and domain3.net. These domains are all using the same IP ...
0
votes
2answers
559 views

Apache SSL virtual host using SNI ignores ServerName

I would like to serve SNI-enabled clients that send the wrong host name a 400 Bad Request, but Apache always serves the default virtual host in this situation. I cannot add a default virtual host that ...
0
votes
1answer
739 views

nginx and SNI: is it possible to automatically resolve SSL certificate by domain name

I need to setup a server that will server same content over SSL using different domain names. The problem is that I need an ability to add new domain names as easily as possible. Assuming that all ...
0
votes
1answer
150 views

Nginx Vhosts with SSL

I have 3 domains running on an nginx server with ssl domain.pw domain.info domain.mobi i have sni enabled, and am using a vhost for each site. the host records for the site are all like this A ...
1
vote
1answer
942 views

stunnel client uses improper SNI when talking to Apache

I have stunnel listening on port 80 and acting as a client connecting to Apache listening on port 443. Configuration is below. What I'm finding is that if I attempt to connect to localhost:80 the ...
6
votes
1answer
750 views

How to stop HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (Apache-SNI)

I hope that title is clear. How do I prevent HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (setup is Apache-SNI). For example, using my abbreviated ...
3
votes
2answers
407 views

What happens when a browser does not support SNI

A seemingly simple question, but valid nonetheless. What exactly happens when a browser which does not support SNI attempts to visit a site configured to force SSL via SNI. Thanks
1
vote
0answers
143 views

Apache2 conditional section based on port

I don't know much about if statements in apache configuration, and I'm wondering if I can have a section of the configuration applied only if the request is received on a certain port. In short, this ...
2
votes
2answers
287 views

Stop default SSL response on Shared IP using SNI

Previously I asked a question here: Single domain SSL presented for all domains on Shared IP about setting up secure and non-secure domains on a single IP. Opinions were mixed, but it appears SNI ...
1
vote
3answers
4k views

Apache SNI namevhosts always route to first VirtualHost entry

Update So for some strange reason, the problem seems to have resolved itself. Perhaps it's some sort of strange caching issue or something (though I have apache2ctl stop/start/restart and sudo ...
-1
votes
1answer
67 views

Is it possible to log the IP address for SNI in apache logs on errors?

Is it possible to log the IP address associated with SNI in the apache logs? I realize that this is SSL when it connects, so if its not now, Im wondering if apache would add it so at least we could ...
8
votes
2answers
7k views

How can I detect if a server is using SNI for HTTPS?

I'm looking for a simple way to know if a server is using the Server Name Indication SSL extension for its HTTPS certificate on a website. A method that uses either a browser or Unix command line is ...
5
votes
1answer
2k views

How to define which SSL certificate nginx sends first with SNI?

I use nginx 1.2.7 with OpenSSL 0.9.8o on Debian Squeeze for about 30 domains. On two of them I enabled SSL which works fine on both. The SSL config is use for both domains: listen 443 ssl; ...