1

SNI (Server Name Indication) is an extension to the TLS/SSL protocol, allowing the webserver to serve multiple domains on the same IP, all with different SSL server certificates. SNI discovers the SSL certificate appropriate for the domain/URL they are asking for. Before SNI, all vhosts listening on the same IP & port had to be presented with the same SSL certificate.

Anyone know if there's a limit to the number of domains that I can have serving on the same IP?

With standard http, there is no limit. I just specify a different vhost for each domain, and the webserver matches the client's "Host:" header to the matching server_name or server_alias vhost. SNI works similarly, but matches SSL certificates and there could be hundreds on one IP. I wonder if anyone knows if SNI has a limit or performs slowly with hundreds of certificates on the same IP.

2

SNI is essentially the same as the Host header in HTTP. The main difference is that the Host header is only inside the HTTP request and thus can only be seen by the web server after the TLS handshake is already successfully finished. The SNI extension instead is send within the ClientHello, i.e. the initial message sent by the client inside the TLS handshake. The server then extracts the SNI extension from the TLS handshake to find the matching configuration (which includes the certificate) the same way as it extracts the value of the Host header to find the matching configuration.

Based on this there should be no qualitative difference and no additional limit with SNI vs Host header. But there will be some quantitative difference in that more memory will be needed with SNI compared to only Host header: additionally to the HTTP part of the configuration also the SSL part needs to be kept in memory, i.e. specifically the certificate, certificate chain and private key.

  • Wonder if SNI works with IP address as well as host name? – Egbert S May 13 '17 at 16:19
  • @EgbertS: this is a different question. But to answer it you might look into RFC 6066 where the SNI extension is defined: Currently, the only server names supported are DNS hostnames. Thus: no IP addresses. And it would not make any sense either because the reason SNI is used in the first place is have different certificates for the different hostnames on the same IP address. – Steffen Ullrich May 13 '17 at 16:25
  • Wow. So, once a SNI-compliant web server takes over the IP address at the interface, there is no way to serve HTTPS a using that IP as a host name at THAT same IP address, right? – Egbert S May 13 '17 at 16:32
  • An SNI compliant web server can also support clients which do not use SNI. And if the URL is https://ip/ then the browser will not use the SNI extension. But again, these are new questions and should not be asked as comment. – Steffen Ullrich May 13 '17 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.