5

Is it a good idea to set Apache's SSLStrictSNIVHostCheck on at the server level? Is it a better idea to set it just for a virtual host?

What are the pros and cons of this setting?

1
3

It depends on why you are running a secure server. if you are using SNIV to get multiple virtual hosts on a single IP address, each with a different cert, does it matter if someone with a browser that does not support SNIV can connect to the first site with the wrong name? If it does, then you should set it to on. If it doesn't, set it to off.

See http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslstrictsnivhostcheck

2
  • Ok, what happen if I have only one Virtual host with SSL and I move it as a first one and set SSLStrictSNIVHostCheck off? Will works SNI-aware and SNI-unaware clients correctly? What happen in case I have two Virtual Hosts with SSL and I set a.com as a first and b.com as a second and set SSLStrictSNIVHostCheck off? Will SVN-unaware clients for b.com works correctly with certificate for a.com? Jun 7 '13 at 5:50
  • The answer to all of those questions is on the link provided. It explains exactly what affect the setting will have in each situation. What I don't understand is how a subsequent VirtualHost block could ever be visited by an SSL client who is not on SNI, since that client would always be getting served by the default block, which is the reason for SNI in the first place.
    – user357577
    Mar 26 '17 at 22:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.