2

I am working on multiple domain certificates using stunnel. I have two domains test.int and test1.int and given multiple certificates to each domain and one default certificate. I used sni option of stunnel to provide multiple domain certificates. Using javascript websocket i am trying to connect to secure server, But log file output shows

SNI: extension not received from the client

So i am not sure about sni option supports or not. Could any one help me to explain its working or not. What is the meaning of "SNI: extension not received from the client" statement.

Thanks in advance for your valuable answers.

My stunnel.config file

output=/var/log/stunnel.log
pid=
debug = 7
fips = no
compression = rle

options = NO_SSLv2

syslog = no

[websockets]
cert = /usr/local/etc/stunnel/default.crt
key = /usr/local/etc/stunnel/default.key
accept  = 0.0.0.0:9443
connect = 127.0.0.1:9000


[sni1]
sni = websockets:mailxf.test.int
cert = /usr/local/etc/stunnel/test.int.crt
key = /usr/local/etc/stunnel/test.int.key
connect = 127.0.0.1:9000

[sni2]
sni = websockets:mailxf.test1.int
cert = /usr/local/etc/stunnel/test1.int.crt
key = /usr/local/etc/stunnel/test1.int.key
connect = 127.0.0.1:9000

Log file output

Service [websockets] accepted (FD=9) from 192.168.0.132:38257
2014.04.14 18:30:32 LOG7[7085:139648669734672]: Service [websockets] started
2014.04.14 18:30:32 LOG5[7085:139648669734672]: Service [websockets] accepted connection from 192.168.0.132:38257
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): before/accept initialization
**2014.04.14 18:30:32 LOG5[7085:139648669734672]: SNI: extension not received from the client**
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 read client hello A
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 write server hello A
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 write change cipher spec A
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 write finished A
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 flush data
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 read finished A
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    2 items in the session cache
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    0 client connects (SSL_connect())
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    0 client connects that finished
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    0 client renegotiations requested
2014.04.14 18:30:32 LOG7[7085:139648669734672]:   19 server connects (SSL_accept())
2014.04.14 18:30:32 LOG7[7085:139648669734672]:   19 server connects that finished
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    0 server renegotiations requested
2014.04.14 18:30:32 LOG7[7085:139648669734672]:   14 session cache hits
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    0 external session cache hits
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    0 session cache misses
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    2 session cache timeouts
2014.04.14 18:30:32 LOG6[7085:139648669734672]: SSL accepted: previous session reused
2014.04.14 18:30:32 LOG6[7085:139648669734672]: connect_blocking: connecting 127.0.0.1:9000
2014.04.14 18:30:32 LOG7[7085:139648669734672]: connect_blocking: s_poll_wait 127.0.0.1:9000: waiting 10 seconds
2014.04.14 18:30:32 LOG5[7085:139648669734672]: connect_blocking: connected 127.0.0.1:9000
2014.04.14 18:30:32 LOG5[7085:139648669734672]: Service [websockets] connected remote server from 127.0.0.1:44325
2014.04.14 18:30:32 LOG7[7085:139648669734672]: Remote socket (FD=10) initialized

Javascript code to connect secure server,

wss://mailxf.test.int:9443/bo/socket.bo.php

I am using webbrowser version as Chrome 26 and firefox 24 and OS version centos 6.

  • It would probably be helpful if you included a few lines of the JavaScript you use to instantiate and connect with a secure WebSocket – Mathias R. Jessen Apr 14 '14 at 14:46
  • Are you sure this syntax is correct: sni = websockets:mailxf.test.int? – David Schwartz Apr 15 '14 at 6:08
  • @DavidSchwartz yes, syntax is right <master service>:<sni host> This syntax referred from given link, stunnel.org/pipermail/stunnel-users/2011-June/003132.html – Kaustubh Khare Apr 15 '14 at 6:18
  • The meaning of the statement is that your client is not supporting SNI. – Jenny D Apr 15 '14 at 6:19
1

You tried to connect directly to an IP address, rather than a hostname. So there wouldn't be any point to SNI, as you didn't provide a name. You're meant to use the hostname.

For instance:

wss://example.com:9443/bo/socket.bo.php
  • i edited my question and add host name instead of ip address, but same notice line present in log file. – Kaustubh Khare Apr 15 '14 at 5:30
  • Internally server was reading ip address instead of hostname. Now I changed configurations, ip replaced by hostname. Its working now. Thank you very much. – Kaustubh Khare Apr 15 '14 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.