Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address

learn more… | top users | synonyms

0
votes
2answers
3k views

Hostname and SSL (apache) issue on Debian

I have been trying to setup SSL virtual host <VirtualHost *:443> ServerAdmin webmaster@mts.com ServerName moclm.tap.pt SSLEngine on SSLCertificateFile /etc/ssl/moclm.cer ...
0
votes
1answer
32 views

Nginx default SSL Host: Disable completely or…?

I have many SSL Hosts on my server serving via Nginx SNI. However, when I enter the IP address of that server, I will see the first configured virtual host with a certificate warning. Is it possible ...
0
votes
0answers
26 views

Azure Web App Service - Installed SSLcert from SSLs.com OK, but nothing works

I successfully deployed my .net webapplication to Azure App Services (WebApp), access to http ://mywebappAAA.azurewebsites.net and https ://mywebappAAA.azurewebsites.net are working properly. I ...
0
votes
0answers
16 views

IIS 8 - Default SSL Site Breaks SNI

We have the following scenario in testing SNI on Windows Server 2012 R2 with IIS 8. Domain names and IP addresses listed below are fake and for example only. WEB SITE NAME IP ADDRESS Host ...
1
vote
1answer
571 views

curl 7.21 does not correctly call a host with a host header on https

We found out that calling a host like following using curl 7.21 or 7.24 does produce an error in the apache config (we have multiple SSL Vhosts!). Whereas the same command runs smooth with curl 7.34 ...
0
votes
1answer
28 views

SNI: Can I find out which hosts share the same IP? [closed]

The setup is the following: I know that a host uses SNI (e.g. universal.at on IP 91.236.122.125, the test says so). I know that I can find out one other host that is also hosted on the same IP ...
0
votes
1answer
40 views

Apache configuration using SNI and mix of SSL certs

Up to this point I've been using SNI in my ssl.conf file with Apache 2.2.31 I'm serving up different sites all in the same document root. For example: NameVirtualHost *:443 <VirtualHost *:443> ...
93
votes
5answers
57k views

Multiple SSL domains on the same IP address and same port?

This is a Canonical Question about Hosting multiple SSL websites on the same IP. I was under the impression that each SSL Certificate required it's own unique IP Address/Port combination. But the ...
1
vote
0answers
13 views

stunnel does not handle SNI correctly

I am trying to get stunnel-4.53-1.1 in Debian Wheezy running. The important parts of my configuration (/etc/stunnel/stunnel.conf) look like that: [https] cert = /etc/ssl/certs/mydomain.pem key = ...
4
votes
3answers
7k views

Jenkins reports reverse proxy setup incorrect with Apache using virtual hosts with SNI

I'm setting up a Jenkins server, to run under Tomcat behind Apache. I'm using virtual hosts with SSL using SNI so I can access it at https://jenkins.example.com, and serve something else on, say, ...
-1
votes
1answer
59 views

TLS SNI alternative in apache

Is it possible to serve different public certificates based on the port the client is connecting? I am aware that using SNI (in conjunction with NameVirtualHost) server will respond with appropriate ...
0
votes
1answer
177 views

Transparent HTTP/HTTPS domain filtering proxy [closed]

I want to set up a transparent HTTP/HTTPS proxy to filter outbound requests based on destination hostname (domain). The proxy itself should be non-intrusive and just forward traffic, not ...
10
votes
2answers
3k views

Can a Reverse Proxy use SNI with SSL pass through?

I need to serve several applications over https using one external ip address. The ssl certificates should not be managed on the reverse proxy. They are installed on the application servers. Can a ...
0
votes
3answers
40 views

How to disable unconfigured HTTPS domains in apache2.4?

I want the server to respond to https://abc.def.com, but not to https://def.com, while still serving http://def.com when both domains point to the same IP address. I currently have a configuration ...
1
vote
1answer
109 views

Separate SSL certificate per webapp under Java app server on a single IP

We have a production Apache Tomcat server over which some websites are served. The sites have started to request valid SSL certificates. We have some limitations on the number of valid IPs on our ...
0
votes
0answers
52 views

Multiple ssl certificates in IIS without SNI

We are hosting a service on https and have 2 certificates CN=server.internalDns.domain.com CN=server.externalDns.domain.com We would like to generate multiple bindings on the default web site ...
2
votes
1answer
112 views

Social networks and Cloudflare free SSL

Let me expose my setup and problems. Maybe some of you will have ideas for me to test. Setup On Digital Ocean : I have one web server running a web site with NGINX in the front (Ruby on Rails ...
0
votes
0answers
23 views

HTTPS requests to an SNI hosted site not loading non-ssl resources

I've got a site we just moved to SSL using SNI and have some odd behavior going on. If you make a browser request VIA HTTPS - the browser will not load all the resources, external fonts, css and js ...
0
votes
0answers
93 views

SSL with Virtual Hosts Using SNI (multiple name based configs) - Need to get working with client certificate

I have the following configuration along with other name based virtual hosts. All others work fine but this one fails when enabling certificate authentication with the following error: Non-default ...
1
vote
1answer
310 views

Apache2/Ubuntu 14.04 error.log Hostname provided via SNI and hostname provided via HTTP are different

In my apache2 error.log I see every few minutes an error message “Hostname … provided via SNI and hostname www.google.com.hk provided via HTTP are different”. In the access.log each error can be often ...
3
votes
2answers
602 views

Disabling SNI for specific virtualhost on Apache

We have a web server with a couple of internet IPs. I have successfully set up SNI name based virtualhosts, it's working great. What I'd like to do though is have our main site NOT use SNI and use ...
0
votes
0answers
200 views

How to enable SNI with Apache in Redhat 5.11

I am on redhat 5.11. I want to enable SNI with apache, but I only have Apache/2.2.3 + OpenSSL 0.9.8e-fips-rhel5. I am in a very similar situation like this ...
3
votes
1answer
232 views

Nginx: SNI doesn't work for server_name with multiple arguments

With this Nginx config: server { listen 443 ssl; server_name www.x.nl x.nl; ssl_certificate /etc/nginx/ssl/x.nl.crtkeyca; ssl_certificate_key /etc/nginx/ssl/x.nl.crtkeyca; ...
2
votes
1answer
90 views

Pick SSL cert based on domain name without separate VHosts

I'm working with a WordPress multi-site network that has various top-level domain names. We're currently serving them all up with one virtual host: <VirtualHost *:80> ServerName ...
6
votes
1answer
3k views

How to define which SSL certificate nginx sends first with SNI?

I use nginx 1.2.7 with OpenSSL 0.9.8o on Debian Squeeze for about 30 domains. On two of them I enabled SSL which works fine on both. The SSL config is use for both domains: listen 443 ssl; ...
11
votes
3answers
18k views

“Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile]” error

After recently upgrading Apache2 to version 2.2.31 I found a strange behaviour in SSL VirtualHost setup. A few of the website I'm hosting were showing the certificate for the default host even if the ...
1
vote
0answers
101 views

Does SNI really require TLSv1 (insecure)?

From the Apache 2.4 docs: The first (default) vhost for SSL name-based virtual hosts must include TLSv1 as a permitted protocol, otherwise Apache will not accept the SNI information from the ...
6
votes
1answer
528 views

Does SNI represent a privacy concern for my website visitors?

Firstly, I'm sorry for my bad English. I'm still learning it. Here it goes: When I host a single website per IP address, I can use "pure" SSL (without SNI), and the key exchange occurs before the ...
1
vote
1answer
309 views

How to use SSL Name Based Vhosts without SNI

I need to host a handful of web applications over SSL using name based virtual hosting. Apache documentation indicates this is possible (https://wiki.apache.org/httpd/NameBasedSSLVHosts) if all sites ...
1
vote
1answer
839 views

SSL with Virtual Hosts Using SNI

I am using RHEL 6, httpd-2.4.10, openssl-1.0.2a and I have setup SNI as explained in http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI Everytime I restart apache I get following message: ...
1
vote
1answer
288 views

SNI (SSL) support on Facebook built-in browser on Android [closed]

This issue in the Android bug tracker seems to suggest that SNI has been part of the Android OS now for some time so I'm surprised to find that visiting our CloudFlare Flexible-SSL enabled site throws ...
3
votes
1answer
2k views

SNI error over SSL on some Android devices

I am getting an SNI error: Hostname X provided via SNI, but no hostname provided in HTTP request On some Android phones when making SSL requests to my domain. This is despite ensuring that the Host ...
13
votes
2answers
12k views

How can I detect if a server is using SNI for HTTPS?

I'm looking for a simple way to know if a server is using the Server Name Indication SSL extension for its HTTPS certificate on a website. A method that uses either a browser or Unix command line is ...
2
votes
2answers
249 views

Command line to set up SNI on IIS for Windows 2012

I'm trying to complete the automated build script of my web server, which runs Windows 2012 and has two SSL websites, each with its own digital certificate. I am using SNI, which works fine when I ...
0
votes
0answers
123 views

How to reverse proxy with SSL using apache

I have two SSL enabled servers. I want to be able to visit https://server1.com/foo/bar and have server1 reverse proxy the request over to https://server2.com/bar. Server2 has several https virtual ...
0
votes
3answers
68 views

Server setup for SSL for sending and receiving emails?

I managed to setup one physical server using postfix, dovecot with mysql server. I do plan to use virtual domains and users. Current setup to send and receive emails. SENDING smtp.example.com ...
3
votes
1answer
463 views

Cannot disable SNI on Windows Server 2012

I have two different 'families' of related sites, each with their own UCC certificate on the same server. I'm hosting them on the same IIS server, using one IP address for each family. Both UCC ...
0
votes
1answer
70 views

Dedicated server issues with SSL and IPs, content showing on wrong site [closed]

We have a number of sites on this dedicated server. Pages from one site are showing up on another site. Example: clientsite1.com (right site, no SSL installed) clientsite2.com (forwards to SSL, ...
2
votes
1answer
1k views

How to configure SNI so as to have benifits of SNI [closed]

How can i configure SNI to get the benifts ...........I am using openssl 1.0.0 beta5 and apache 2.2.14. Can anyone tell me the complete procedure . I am configuring virtual host in ssl.conf files and ...
2
votes
2answers
432 views

SSL SNI security concerns

Just wondering if SNI is useful in segregating public content from private content. I managed to configure our server to serve /foo for every client but serve /bar only for clients from the intranet, ...
0
votes
0answers
217 views

How to configure HAProxy to use SNI for SSL enabled backends?

I have several backend web servers that have multiple vhosts and I want to use HAProxy in front of them. It doesn't appear that HAProxy is sending the hostname in the TLS connection to the backend ...
0
votes
0answers
112 views

Server returning 404 for only Baiduspider

I recently updated my website to enforce HTTPS for all requests. Everything appears to be working well after this change but Baidu's web crawler (Baiduspider) is receiving a 404 for all requests. ...
1
vote
0answers
84 views

Do modern web browsers always send the web server's hostname in the SNI extension header?

When a web browser that supports Server Name Indication (SNI) connects to an HTTPS site, does it ALWAYS send the hostname in the SNI field? That is, there is no way for a web browser to know if the ...
4
votes
2answers
503 views

What happens when a browser does not support SNI

A seemingly simple question, but valid nonetheless. What exactly happens when a browser which does not support SNI attempts to visit a site configured to force SSL via SNI. Thanks
0
votes
2answers
203 views

SNI for multi tenant load balancing in 2015

We're a multi-tenant service and terminate our SSL at our load balancers (HAProxy + Apache for SSL termination), this has caused growing pains due to dedicated IP requirements. But times have changed ...
0
votes
1answer
829 views

How to fix the TLS Server Name Indication issue under Windows XP on Nginx using a different IP

I have a server that is using two different domains with two different certificates. Everithing work fine except IE8 on Windows XP because the TLS Server Name Indication is not supported there. In ...
2
votes
1answer
548 views

How to serve multiple SSL certificates for the default virtual host on NGINX?

I have a static app on Amazon S3 that is served through a NGINX proxy. The purpose I use a proxy is to allow users to point their domains to my Amazon EC2 instance (via CNAME record pointing to ...
0
votes
1answer
82 views

Browser gets two different SSL certificates instead of one (IE only) [closed]

It seems the problem appears only for IE11 (Win) users, for other OS and browsers HTTPS connection works fine. IE11 firstly gets outdated SSL certificate warning You ignore warning, proceed anyway ...
3
votes
1answer
5k views

HAProxy with SNI and different SSL Settings

I have HAProxy for my two sites, one of them public and one private. www.mysite.com private.mysite.com Atm, I'm using haproxy like this: frontend mysite_https bind *.443 ssl crt /etc/mycert.pem ...
8
votes
3answers
2k views

SNI and wildcard SSL certificates on the same server with IIS

I'd like to host a website that should listen to subdomains (e.g. sub.domain.com) together with multiple websites that live just under a second-level domain (e.g. domain2.com, domain3.com) with IIS ...