I wonder if browsers can and do re-use the same connection when both domain names resolve to the same IP and both are covered by a single certificate (SAN) when used together on one web site.

Example: I have a certificate covering example.com and example.org in its SubjectAltName. On https://example.com/ I embed images from https://example.org/. Is a (perhaps slow) SSL/TLS handshake for example.org needed?


Because the browser does not know up-front that it will get the same certificate when connecting to another hostname, even if the IP is the same (because of server name indication) it cannot reuse the same connection. Even if the certificate it gets for example.org includes example.com it cannot be sure, that it will get the same certificate when connecting to example.com.

  • When there is an established TLS connection, I can request HTTP files from other domains, too. And if the certificate is valid for the other domain, why shouldn't browsers do that. Or do they generally avoid using connection across domains? How about spdy? My TLS handshake takes some time, so I'd like to get that speeded up. – YetAnotherGuest Sep 6 '14 at 11:49
  • The browser will not know up-front which certificate it will get when doing a new ClientHello with a different name in the server name extension. While it might be the same certificate it might be also a different one - it is easy to configure a server this way. Thus it cannot reuse the connection. – Steffen Ullrich Sep 6 '14 at 14:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.