Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address

learn more… | top users | synonyms

0
votes
0answers
15 views

Can I use undocumented SNI in IIS 7.5 in production? [on hold]

We have a server with one IP address, IIS 7.5 and two websites hosted there. Both websites are on the same port, hostname bindings are used. We want to enable SSL for both of websites. SNI allows ...
0
votes
0answers
29 views

Can NGINX inspect the TLS request to look for SNI like HAProxy (etc) does?

It seems that, when configuring HAProxy for hostname routing on HTTPS connections, it is crucial to include a tcp-request inspect-delay directive to "give HAProxy a chance to look into the ...
2
votes
1answer
52 views

Does NGINX support SNI or does it not?

EDIT New question: Can NGINX inspect the TLS request to look for SNI like HAProxy (etc) does? According to what I've read around (and I've been told), NGINX should not support SNI and I should go for ...
1
vote
0answers
34 views

Use postfix through a proxy. How should it be configured?

Postfix by default uses ports 25, 465 and 587. In my configuration, I enabled TLS encryption using the option smtpd_use_tls=yes in postfix's main.cf. This makes all smtp communications encrypted as ...
0
votes
0answers
33 views

Azure Web App Service - Installed SSLcert from SSLs.com OK, but nothing works

I successfully deployed my .net webapplication to Azure App Services (WebApp), access to http ://mywebappAAA.azurewebsites.net and https ://mywebappAAA.azurewebsites.net are working properly. I ...
0
votes
1answer
35 views

Nginx default SSL Host: Disable completely or…?

I have many SSL Hosts on my server serving via Nginx SNI. However, when I enter the IP address of that server, I will see the first configured virtual host with a certificate warning. Is it possible ...
0
votes
0answers
18 views

IIS 8 - Default SSL Site Breaks SNI

We have the following scenario in testing SNI on Windows Server 2012 R2 with IIS 8. Domain names and IP addresses listed below are fake and for example only. WEB SITE NAME IP ADDRESS Host ...
0
votes
1answer
28 views

SNI: Can I find out which hosts share the same IP? [closed]

The setup is the following: I know that a host uses SNI (e.g. universal.at on IP 91.236.122.125, the test says so). I know that I can find out one other host that is also hosted on the same IP ...
0
votes
1answer
42 views

Apache configuration using SNI and mix of SSL certs

Up to this point I've been using SNI in my ssl.conf file with Apache 2.2.31 I'm serving up different sites all in the same document root. For example: NameVirtualHost *:443 <VirtualHost *:443> ...
1
vote
0answers
14 views

stunnel does not handle SNI correctly

I am trying to get stunnel-4.53-1.1 in Debian Wheezy running. The important parts of my configuration (/etc/stunnel/stunnel.conf) look like that: [https] cert = /etc/ssl/certs/mydomain.pem key = ...
-1
votes
1answer
62 views

TLS SNI alternative in apache

Is it possible to serve different public certificates based on the port the client is connecting? I am aware that using SNI (in conjunction with NameVirtualHost) server will respond with appropriate ...
0
votes
1answer
223 views

Transparent HTTP/HTTPS domain filtering proxy [closed]

I want to set up a transparent HTTP/HTTPS proxy to filter outbound requests based on destination hostname (domain). The proxy itself should be non-intrusive and just forward traffic, not ...
0
votes
3answers
47 views

How to disable unconfigured HTTPS domains in apache2.4?

I want the server to respond to https://abc.def.com, but not to https://def.com, while still serving http://def.com when both domains point to the same IP address. I currently have a configuration ...
1
vote
1answer
123 views

Separate SSL certificate per webapp under Java app server on a single IP

We have a production Apache Tomcat server over which some websites are served. The sites have started to request valid SSL certificates. We have some limitations on the number of valid IPs on our ...
0
votes
0answers
57 views

Multiple ssl certificates in IIS without SNI

We are hosting a service on https and have 2 certificates CN=server.internalDns.domain.com CN=server.externalDns.domain.com We would like to generate multiple bindings on the default web site ...
0
votes
0answers
24 views

HTTPS requests to an SNI hosted site not loading non-ssl resources

I've got a site we just moved to SSL using SNI and have some odd behavior going on. If you make a browser request VIA HTTPS - the browser will not load all the resources, external fonts, css and js ...
0
votes
0answers
105 views

SSL with Virtual Hosts Using SNI (multiple name based configs) - Need to get working with client certificate

I have the following configuration along with other name based virtual hosts. All others work fine but this one fails when enabling certificate authentication with the following error: Non-default ...
1
vote
1answer
320 views

Apache2/Ubuntu 14.04 error.log Hostname provided via SNI and hostname provided via HTTP are different

In my apache2 error.log I see every few minutes an error message “Hostname … provided via SNI and hostname www.google.com.hk provided via HTTP are different”. In the access.log each error can be often ...
3
votes
2answers
692 views

Disabling SNI for specific virtualhost on Apache

We have a web server with a couple of internet IPs. I have successfully set up SNI name based virtualhosts, it's working great. What I'd like to do though is have our main site NOT use SNI and use ...
0
votes
0answers
209 views

How to enable SNI with Apache in Redhat 5.11

I am on redhat 5.11. I want to enable SNI with apache, but I only have Apache/2.2.3 + OpenSSL 0.9.8e-fips-rhel5. I am in a very similar situation like this ...
2
votes
1answer
119 views

Social networks and Cloudflare free SSL

Let me expose my setup and problems. Maybe some of you will have ideas for me to test. Setup On Digital Ocean : I have one web server running a web site with NGINX in the front (Ruby on Rails ...
2
votes
1answer
128 views

Does SNI really require TLSv1 (insecure)?

From the Apache 2.4 docs: The first (default) vhost for SSL name-based virtual hosts must include TLSv1 as a permitted protocol, otherwise Apache will not accept the SNI information from the ...
3
votes
1answer
238 views

Nginx: SNI doesn't work for server_name with multiple arguments

With this Nginx config: server { listen 443 ssl; server_name www.x.nl x.nl; ssl_certificate /etc/nginx/ssl/x.nl.crtkeyca; ssl_certificate_key /etc/nginx/ssl/x.nl.crtkeyca; ...
2
votes
1answer
90 views

Pick SSL cert based on domain name without separate VHosts

I'm working with a WordPress multi-site network that has various top-level domain names. We're currently serving them all up with one virtual host: <VirtualHost *:80> ServerName ...
1
vote
1answer
915 views

SSL with Virtual Hosts Using SNI

I am using RHEL 6, httpd-2.4.10, openssl-1.0.2a and I have setup SNI as explained in http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI Everytime I restart apache I get following message: ...
1
vote
1answer
298 views

SNI (SSL) support on Facebook built-in browser on Android [closed]

This issue in the Android bug tracker seems to suggest that SNI has been part of the Android OS now for some time so I'm surprised to find that visiting our CloudFlare Flexible-SSL enabled site throws ...
2
votes
2answers
261 views

Command line to set up SNI on IIS for Windows 2012

I'm trying to complete the automated build script of my web server, which runs Windows 2012 and has two SSL websites, each with its own digital certificate. I am using SNI, which works fine when I ...
0
votes
3answers
70 views

Server setup for SSL for sending and receiving emails?

I managed to setup one physical server using postfix, dovecot with mysql server. I do plan to use virtual domains and users. Current setup to send and receive emails. SENDING smtp.example.com ...
3
votes
1answer
492 views

Cannot disable SNI on Windows Server 2012

I have two different 'families' of related sites, each with their own UCC certificate on the same server. I'm hosting them on the same IIS server, using one IP address for each family. Both UCC ...
0
votes
1answer
71 views

Dedicated server issues with SSL and IPs, content showing on wrong site [closed]

We have a number of sites on this dedicated server. Pages from one site are showing up on another site. Example: clientsite1.com (right site, no SSL installed) clientsite2.com (forwards to SSL, ...
2
votes
2answers
435 views

SSL SNI security concerns

Just wondering if SNI is useful in segregating public content from private content. I managed to configure our server to serve /foo for every client but serve /bar only for clients from the intranet, ...
0
votes
0answers
222 views

How to configure HAProxy to use SNI for SSL enabled backends?

I have several backend web servers that have multiple vhosts and I want to use HAProxy in front of them. It doesn't appear that HAProxy is sending the hostname in the TLS connection to the backend ...
0
votes
0answers
117 views

Server returning 404 for only Baiduspider

I recently updated my website to enforce HTTPS for all requests. Everything appears to be working well after this change but Baidu's web crawler (Baiduspider) is receiving a 404 for all requests. ...
1
vote
0answers
87 views

Do modern web browsers always send the web server's hostname in the SNI extension header?

When a web browser that supports Server Name Indication (SNI) connects to an HTTPS site, does it ALWAYS send the hostname in the SNI field? That is, there is no way for a web browser to know if the ...
0
votes
2answers
210 views

SNI for multi tenant load balancing in 2015

We're a multi-tenant service and terminate our SSL at our load balancers (HAProxy + Apache for SSL termination), this has caused growing pains due to dedicated IP requirements. But times have changed ...
2
votes
1answer
601 views

How to serve multiple SSL certificates for the default virtual host on NGINX?

I have a static app on Amazon S3 that is served through a NGINX proxy. The purpose I use a proxy is to allow users to point their domains to my Amazon EC2 instance (via CNAME record pointing to ...
0
votes
1answer
82 views

Browser gets two different SSL certificates instead of one (IE only) [closed]

It seems the problem appears only for IE11 (Win) users, for other OS and browsers HTTPS connection works fine. IE11 firstly gets outdated SSL certificate warning You ignore warning, proceed anyway ...
3
votes
1answer
5k views

HAProxy with SNI and different SSL Settings

I have HAProxy for my two sites, one of them public and one private. www.mysite.com private.mysite.com Atm, I'm using haproxy like this: frontend mysite_https bind *.443 ssl crt /etc/mycert.pem ...
1
vote
1answer
596 views

curl 7.21 does not correctly call a host with a host header on https

We found out that calling a host like following using curl 7.21 or 7.24 does produce an error in the apache config (we have multiple SSL Vhosts!). Whereas the same command runs smooth with curl 7.34 ...
3
votes
1answer
693 views

Can TLSv1 / SNI be blocked by the network? (routers, firewalls, etc)

Our web site serves static content through a content delivery network (AWS CloudFront) which is configured to respond to a number of CNAMEs and use our SSL wildcard certificate for these hostnames. ...
1
vote
1answer
338 views

apache always serves first named vhost regardless of SNI setting

Apache is always serving the first named vhost regardless of SNI setting. I'm unsure what is causing this. I no longer get the message Init: Name-based SSL virtual hosts only work for clients with ...
10
votes
2answers
3k views

Can a Reverse Proxy use SNI with SSL pass through?

I need to serve several applications over https using one external ip address. The ssl certificates should not be managed on the reverse proxy. They are installed on the application servers. Can a ...
0
votes
0answers
1k views

Apache mod_proxy with HTTPS without key material (using SNI)

I would like to have an Apache 2.4 proxy which redirects port 80 and 443 requests to different machines in the local network, depending on the host name. I used mod_proxy and it works fine with port ...
0
votes
3answers
568 views

Strict SNI matching for Apache

I have multiple SSL vhosts and non-SSL vhosts served from a single server. If one of the non-ssl vhosts is accessed using "https", the first SSL directive is used. Is there some setting to make it so ...
3
votes
1answer
2k views

SNI error over SSL on some Android devices

I am getting an SNI error: Hostname X provided via SNI, but no hostname provided in HTTP request On some Android phones when making SSL requests to my domain. This is despite ensuring that the Host ...
1
vote
1answer
312 views

How to use SSL Name Based Vhosts without SNI

I need to host a handful of web applications over SSL using name based virtual hosting. Apache documentation indicates this is possible (https://wiki.apache.org/httpd/NameBasedSSLVHosts) if all sites ...
1
vote
2answers
684 views

Apache SNI, 2 domains, 2 certs, resolves to same document root

I am currently following the following guide: https://www.digitalocean.com/community/articles/how-to-set-up-multiple-ssl-certificates-on-one-ip-with-apache-on-ubuntu-12-04 Setup so far has been ...
0
votes
1answer
216 views

Understanding XP users accessing a UCC certificate on IIS8

I have a single IIS website which hosts 3 different websites all using the same UCC SSL certificate. (The code of my site examines the host header itself to decide which variation of the site to ...
2
votes
1answer
215 views

What does this notice mean “SNI: extension not received from the client”, in stunnel log

I am working on multiple domain certificates using stunnel. I have two domains test.int and test1.int and given multiple certificates to each domain and one default certificate. I used sni option of ...
-3
votes
1answer
318 views

How do I send different SSLCertificateFile based on SSL_TLS_SNI environment variable? [closed]

Idea is to run a wildcard cert off an internal CA for *.domain.com, while public-facing domain.com site is validated by a world recognized CA. Application serving requests is the same though, so I'd ...