27

I have recently moved a WordPress website with a small store from a hosting provider to a server of my own running Ubuntu Server 12.04.2 LTS and Apache 2.2.22. I require SSL for the store. I set up a couple of simple vhosts on a new IP for the server, one binding to port 80 of the specific IP and the other binding to port 443. Both have ServerName www.example.com and ServerAlias example.com in the vhost config. I have SSLStrictSNIVHostCheck off.

The site is running very slow, but is working. I'm getting the following in my error logs.

[Error] Hostname example.com provided via SNI and hostname www.example.com provided via HTTP are different

I expect that the slowness is related to the above message. Any ideas on why that is appearing and what I can do about it?

5 Answers 5

28

Look at your access log (not the error log). With the time and date of the error you should be able to identify the offending request and find out the user agent. In my case, it was a bot:

"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2)"

My Server answers with HTTP 400: Bad Request.

Unless I am mistaken, in TLS negotiations, the client sends the host name twice: once BEFORE the SSL connection is established in the SNI (Server Name Indication) and once AFTER in the actual HTTP request. If the server names mismatch, this would indicate a broken client and should have nothing to do with how your server is configured.

Maybe they will fix their bot someday, in the meantime you can probably ignore it. I doubt this can cause slowness on the host, unless the requests come at a very high rate.

1
  • Hostname 104.239.184.100:443 provided via SNI and hostname 104.239.184.100 provided via HTTP are different was in the error log, and a status 400 in the access log. Hit came from Cloud System Networks, a nebulous "hybrid cloud" monitoring company.
    – Bob Stein
    Nov 7, 2020 at 12:45
16

Maybe this error is evoked intentionally by some clients to test vulnerabilities of your server. I have found that a request from researchscan367.eecs.umich.edu triggered the error on a server I maintain. In this case it is a good thing® that the error occurs.

I was curious what kind of attacks are possible, and I asked this question on Security Stack Exchange: What kind of attack is prevented by Apache2's error code AH02032?

2

In my case the creation of a new virtualhost with an underscore was the problem. I have a wildcard SSL certificate.

Didn't work:

<VirtualHost *:443>
        SSLEngine on
        ServerName sub_domain.example.com
        Redirect / https://www.example.com/restofmyredirectlink
</VirtualHost>

Although Apache did successfully restart, I got HTTP 400 errors. In the error log:

[Wed Sep 05 11:28:00.349960 2018] [ssl:error] [pid 19906:tid 140392626808576] AH02031: Hostname sub_domain.example.com provided via SNI, but no hostname provided in HTTP request

But removing the underscore worked:

<VirtualHost *:443>
        SSLEngine on
        ServerName subdomain.example.com
        Redirect / https://www.example.com/restofmyredirectlink
</VirtualHost>
2
  • 1
    Welcome To ServerFault. Putting underscores in hostnames is against the RFC's and will break in various ways. stackoverflow.com/questions/2180465/…
    – chicks
    Sep 5, 2018 at 14:21
  • 2
    Exactly! So that's why it is now also here as a reference.
    – MS Berends
    Sep 8, 2018 at 10:11
1

Sounds like a client issue at first look... What browser is causing this issue?

The message would suggest the hostname the client sends during the ssl connectionsetup is not the same the client sends in the HTTPS request once the SSL layer is up.

3
  • I don't know what's causing this. The error doesn't report client information. I just know I'm seeing this regularly. I was hoping that the ServerAlias was sufficient to make it happy since in theory the server knows that www.domain.com and domain.com are equivalent.
    – flickerfly
    Dec 17, 2013 at 17:09
  • @flickerfly Yes, this is a buggy client, and not much you can do unless you can identify it. Dec 17, 2013 at 20:23
  • 2
    Okay, just disabled SNI by removing the the NameBasedVirtualHost directive for port 443. I guess I don't need it at this point. I think that's supposed to work.
    – flickerfly
    Dec 17, 2013 at 23:36
0

Check your /etc/hosts file to see if you are assigning the domain name to a local (internal) IP address. Don't forget to restart the name service cache daemon after changing /etc/hosts service nscd restart

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .