Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address

learn more… | top users | synonyms

84
votes
5answers
49k views

Multiple SSL domains on the same IP address and same port?

This is a Canonical Question about Hosting multiple SSL websites on the same IP. I was under the impression that each SSL Certificate required it's own unique IP Address/Port combination. But the ...
13
votes
5answers
8k views

Redirect to SSL only if browser supports SNI

I have Apache 2.2 with mod_ssl and a bunch of sites in HTTPS on the same IP/port with VirtualHosting, so client must support SNI to connect to those virtual hosts. I would like to configure my server ...
8
votes
3answers
490 views

Upgrade HTTP connection to SSL/TLS

I currently have a server which automatically redirects all HTTP requests to the equivalent HTTPS site. The problem is that is seems like some browsers do not accept the SSL certificate (StartSSL.com) ...
8
votes
2answers
7k views

How can I detect if a server is using SNI for HTTPS?

I'm looking for a simple way to know if a server is using the Server Name Indication SSL extension for its HTTPS certificate on a website. A method that uses either a browser or Unix command line is ...
8
votes
3answers
1k views

SNI and wildcard SSL certificates on the same server with IIS

I'd like to host a website that should listen to subdomains (e.g. sub.domain.com) together with multiple websites that live just under a second-level domain (e.g. domain2.com, domain3.com) with IIS ...
7
votes
3answers
13k views

“Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile]” error

After recently upgrading Apache2 to version 2.2.31 I found a strange behaviour in SSL VirtualHost setup. A few of the website I'm hosting were showing the certificate for the default host even if the ...
6
votes
2answers
3k views

using nginx with SNI

By now I've not used SNI with nginx yet. But as IP address pools are quite filled and commercial XP support is about to cease (finally) I'm thinking about converting a few sites to SNI. I'm aware of ...
6
votes
1answer
744 views

How to stop HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (Apache-SNI)

I hope that title is clear. How do I prevent HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (setup is Apache-SNI). For example, using my abbreviated ...
6
votes
1answer
384 views

Does SNI represent a privacy concern for my website visitors?

Firstly, I'm sorry for my bad English. I'm still learning it. Here it goes: When I host a single website per IP address, I can use "pure" SSL (without SNI), and the key exchange occurs before the ...
5
votes
1answer
2k views

How to define which SSL certificate nginx sends first with SNI?

I use nginx 1.2.7 with OpenSSL 0.9.8o on Debian Squeeze for about 30 domains. On two of them I enabled SSL which works fine on both. The SSL config is use for both domains: listen 443 ssl; ...
5
votes
1answer
5k views

Setting up default SSL site on IIS8

I have setup few websites on IIS8 all using the same wildcard SSL certificate. Some of the sites need to be accessible to older browsers and operating systems, therefore I cannot use the "Require ...
5
votes
3answers
2k views

What percentage of web users are running on browsers/OSes that support SNI? [closed]

Has anyone done any analysis (or know where I can find some!) on what proportion of internet users are using a browser/operating system combination that support SNI (Server Name Indication) SSL/TLS ...
5
votes
1answer
2k views

Can a Reverse Proxy use SNI with SSL pass through?

I need to serve several applications over https using one external ip address. The ssl certificates should not be managed on the reverse proxy. They are installed on the application servers. Can a ...
4
votes
3answers
2k views

Problems with multiple SSL on same IP, but only in select clients

I know there are tons of posts about multiple SSL on same IP, but I promise I'm not beating a dead horse. My question is very clear. First, a little background... Our organization has several ...
4
votes
1answer
2k views

Is it possible to get a wildcard cert and use SNI?

I'd like to make setting up new subdomains easy (at least for the development side) and getting one wildcard cert, setting up a wildcard dns (which is done and works great) and setting up SNI (Server ...
4
votes
1answer
786 views

For enabling SSL for a single domain on a server with muliple vhosts, will this configuration work?

I just purchased an SSL certificate to secure/enable only ONE domain on a server with multiple vhosts. I plan on configuring as shown below (non SNI). In addition, I still want to access phpMyAdmin, ...
4
votes
2answers
572 views

Have Nginx reject unknown server names over HTTPS

I have an Nginx instance using SNI to serve multiple HTTPS domains from a single IP. The only glitch with the setup is that Nginx responds with the first (acting as default) domain whenever a URL for ...
3
votes
2answers
5k views

Jenkins reports reverse proxy setup incorrect with Apache using virtual hosts with SNI

I'm setting up a Jenkins server, to run under Tomcat behind Apache. I'm using virtual hosts with SSL using SNI so I can access it at https://jenkins.example.com, and serve something else on, say, ...
3
votes
1answer
300 views

Resolve a many-SSL-to-one IP for clients browsers that doesn't support SNI

Whoa, acronyms :) So according to this question you can have multiple SSL subdomains on one IP address as long as your server supports TLS (which Apache 2.2x does). Another answer to that question ...
3
votes
1answer
673 views

Using SNI on Windows Server 2012 R2 not working

I am trying to get both my sites running with their seperate certificates on a Windows Server 2012 R2. Should this not be possible? On the last added site www.c1get.net I get the certificate from ...
3
votes
1answer
1k views

SNI error over SSL on some Android devices

I am getting an SNI error: Hostname X provided via SNI, but no hostname provided in HTTP request On some Android phones when making SSL requests to my domain. This is despite ensuring that the Host ...
3
votes
1answer
160 views

Cannot disable SNI on Windows Server 2012

I have two different 'families' of related sites, each with their own UCC certificate on the same server. I'm hosting them on the same IIS server, using one IP address for each family. Both UCC ...
3
votes
2answers
405 views

What happens when a browser does not support SNI

A seemingly simple question, but valid nonetheless. What exactly happens when a browser which does not support SNI attempts to visit a site configured to force SSL via SNI. Thanks
3
votes
3answers
8k views

Upgrading OpenSSL in CentOS 5.3

I want to use one IP to host many domains with individual SSL certificates (requires SNI). In CentOS 5.3, the latest version of OpenSSL I can find an RPM for is 0.9.8e, which does not support SNI. I ...
3
votes
1answer
414 views

Can TLSv1 / SNI be blocked by the network? (routers, firewalls, etc)

Our web site serves static content through a content delivery network (AWS CloudFront) which is configured to respond to a number of CNAMEs and use our SSL wildcard certificate for these hostnames. ...
2
votes
2answers
361 views

SSL SNI security concerns

Just wondering if SNI is useful in segregating public content from private content. I managed to configure our server to serve /foo for every client but serve /bar only for clients from the intranet, ...
2
votes
2answers
286 views

Stop default SSL response on Shared IP using SNI

Previously I asked a question here: Single domain SSL presented for all domains on Shared IP about setting up secure and non-secure domains on a single IP. Opinions were mixed, but it appears SNI ...
2
votes
2answers
3k views

Can't turn off SNI on apache

When I go to: http://web-sniffer.net/ and check the headers of my site (https://www.example.org), I get a status code 200 But when I use the radio button HTTP/1.0 (without Host header), I get a ...
2
votes
2answers
877 views

nginx, multiple domains, ssl support for clients without SNI

I want to support SSL for clients which lack of SNI support (IE/FF/Safari on win XP, Android < 2.2, and others). The solution I picked was to have nginx listen on separate port for each ...
2
votes
2answers
7k views

Why does apache httpd tell me that my name-based virtualhosts only works with SNI enabled browers (RFC 4366)

Why does apache give me this error message in my logs? Is it a false positive? [warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366) I ...
2
votes
1answer
67 views

Nginx: SNI doesn't work for server_name with multiple arguments

With this Nginx config: server { listen 443 ssl; server_name www.x.nl x.nl; ssl_certificate /etc/nginx/ssl/x.nl.crtkeyca; ssl_certificate_key /etc/nginx/ssl/x.nl.crtkeyca; ...
2
votes
1answer
2k views

HAProxy with SNI and different SSL Settings

I have HAProxy for my two sites, one of them public and one private. www.mysite.com private.mysite.com Atm, I'm using haproxy like this: frontend mysite_https bind *.443 ssl crt /etc/mycert.pem ...
2
votes
1answer
132 views

Separate SSL certificate selection from virtual host configuration in apache

Currently, my apache configuration includes one SSL certificate (with all domains listed as Alternative Subject Names). I furthermore have one virtual host configuration per domain that serves both ...
2
votes
2answers
678 views

SNI windows xp workaround

Is there some workaround so I can get SNI working for IE on windows xp ?
2
votes
2answers
657 views

Windows Vista Wrong Certificate With SNI

I'm setting up SNI on an apache server and I thought things were going well. I have two URLs from different domains that point at the same site. I have one virtual host setup for each with the ...
2
votes
1answer
31 views

Pick SSL cert based on domain name without separate VHosts

I'm working with a WordPress multi-site network that has various top-level domain names. We're currently serving them all up with one virtual host: <VirtualHost *:80> ServerName ...
2
votes
1answer
146 views

How to serve multiple SSL certificates for the default virtual host on NGINX?

I have a static app on Amazon S3 that is served through a NGINX proxy. The purpose I use a proxy is to allow users to point their domains to my Amazon EC2 instance (via CNAME record pointing to ...
2
votes
1answer
1k views

How to configure SNI so as to have benifits of SNI [closed]

How can i configure SNI to get the benifts ...........I am using openssl 1.0.0 beta5 and apache 2.2.14. Can anyone tell me the complete procedure . I am configuring virtual host in ssl.conf files and ...
2
votes
2answers
61 views

Command line to set up SNI on IIS for Windows 2012

I'm trying to complete the automated build script of my web server, which runs Windows 2012 and has two SSL websites, each with its own digital certificate. I am using SNI, which works fine when I ...
2
votes
1answer
169 views

What does this notice mean “SNI: extension not received from the client”, in stunnel log

I am working on multiple domain certificates using stunnel. I have two domains test.int and test1.int and given multiple certificates to each domain and one default certificate. I used sni option of ...
2
votes
0answers
296 views

Debugging incorrect certificate with SNI for some clients

I have a number of domains with SSL certificates served by Haproxy (using Haproxy 1.5's support for SSL). For the most part the correct certificates are being served, but a particular user is ...
1
vote
1answer
205 views

How to use SSL Name Based Vhosts without SNI

I need to host a handful of web applications over SSL using name based virtual hosting. Apache documentation indicates this is possible (https://wiki.apache.org/httpd/NameBasedSSLVHosts) if all sites ...
1
vote
3answers
4k views

Apache SNI namevhosts always route to first VirtualHost entry

Update So for some strange reason, the problem seems to have resolved itself. Perhaps it's some sort of strange caching issue or something (though I have apache2ctl stop/start/restart and sudo ...
1
vote
1answer
157 views

Understand ssl setup

Goals: If the user support SNI and hit myurl1.server.com (https) or myurl2.server.com (https) it will match the right vhost. (the last 2 vhosts) If the user does not support SNI and hit ...
1
vote
1answer
2k views

Set default TLS SNI vhost for Apache 2.2 on CentOS 6

I have a CentOS 6 server with Apache (httpd-2.2.15-15.el6.centos.x86_64). Now I configured TLS SNI using OpenSSL and that was pretty easy. Now I have two TLS vhosts on the same ip and I want to ...
1
vote
1answer
82 views

SNI (SSL) support on Facebook built-in browser on Android [closed]

This issue in the Android bug tracker seems to suggest that SNI has been part of the Android OS now for some time so I'm surprised to find that visiting our CloudFlare Flexible-SSL enabled site throws ...
1
vote
1answer
288 views

curl 7.21 does not correctly call a host with a host header on https

We found out that calling a host like following using curl 7.21 or 7.24 does produce an error in the apache config (we have multiple SSL Vhosts!). Whereas the same command runs smooth with curl 7.34 ...
1
vote
1answer
240 views

apache always serves first named vhost regardless of SNI setting

Apache is always serving the first named vhost regardless of SNI setting. I'm unsure what is causing this. I no longer get the message Init: Name-based SSL virtual hosts only work for clients with ...
1
vote
2answers
55 views

Correct configuration for SSL over 3 domains on same IP in nginx

I have been working on this for several hours now, to no fruition. Right now I have three domains, for example domain1.com, domain2.org, and domain3.net. These domains are all using the same IP ...
1
vote
1answer
933 views

stunnel client uses improper SNI when talking to Apache

I have stunnel listening on port 80 and acting as a client connecting to Apache listening on port 443. Configuration is below. What I'm finding is that if I attempt to connect to localhost:80 the ...