2

From the Apache 2.4 docs:

The first (default) vhost for SSL name-based virtual hosts must include TLSv1 as a permitted protocol, otherwise Apache will not accept the SNI information from the client and it will be as if the client did not support SNI at all.

I want to have multiple TLS enabled sites on my server, each giving a different certificate. For security reasons, I only allow TLSv1.1 and TLSv1.2. Is there a secure way to turn on SNI?

A snippet from my config:

<VirtualHost *:80>
    ServerName www.example.com
    Redirect permanent / https://www.example.com/
</VirtualHost>

<VirtualHost *:443>
    ServerName www.example.com
    DocumentRoot /var/www/example.com
    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1
    [other SSL options]
</VirtualHost>

<VirtualHost *:80>
    ServerName www.example.org
    Redirect permanent / https://www.example.org/
</VirtualHost>

<VirtualHost *:443>
    ServerName www.example.org
    DocumentRoot /var/www/example.org
    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1
    [other SSL options]
</VirtualHost>
  • 1
    I suspect that's an error. Does the configuration work? – Michael Hampton Jun 19 '15 at 2:51
  • encountered the same problem... – Vitaly May 23 '16 at 11:09
1

The wiki is contrasting TLSv1 from earlier protocols, not later protocols. SNI works fine with TLSv1.1 and TLSv1.2.

  • So you mean it should read "TLSv1 OR LATER" indicating a TLS level must be present. – TomTom May 23 '16 at 13:42
  • In a sense yes. It just requires TLS extensions which are TLS1.0 and later only. TLSv1 is ambiguous, but in a doc that talks about an openssl .9.8 prerequisite take it with grain of salt. (Tried to edit the wiki, but it's notoriously slow.) – covener May 23 '16 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.