Questions tagged [sni]

Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address

Filter by
Sorted by
Tagged with
1
vote
0answers
22 views

SNI fails on nginx - wrong cert being issued

I've been testing my various websites security at Qualsys. All my sites run off of one nginx host. The sites work fine and get an A+ on the Qualsys tests. The only issue that I really want to fix is ...
0
votes
0answers
21 views

nginx tcp proxy routing based on sni

I want to build a tcp proxy based on SNI. The upstream backend is an openshift cluster and I want to block access to certain projects by ip. so the idea is to use a tcp proxy with multiple VIPs. Use ...
1
vote
0answers
14 views

Logging source IP for connection through SNI proxy

I'm using a simple SNI proxy (slt) to forward HTTPS to the correct virtual machine without terminating SSL in the proxy. Something that is glaringly obvious in hindsight: there is no way for me to ...
0
votes
0answers
17 views

Can Apache2.4 match a url to a directory with name-based virtual hosting? [duplicate]

How can Apache2.4 be configured to automaticaly match a url to an identical directory using name-based virtual hosting? By automatic, I mean not having to edit apache2.conf and restart. # default ...
1
vote
1answer
121 views

https with sni two certs tho server names but same config. can I use one server block?

I often encounter following problem. I have an nginx server serving two hostnames via https on the same IP and the same port. Each host name has it's own cert. What I am doing so far is to have two ...
0
votes
0answers
23 views

nginx redirect fails if behind haproxy with tcp mode (wrong port is added to url) [duplicate]

Hi I'm using haproxy as reverse proxy in tcp mode with different backends depending on the SNI headers: The config looks like: # simplified version of ssl_sni front end # the real config checks sni ...
0
votes
0answers
53 views

Does the TLS Cert need to match SNI (server_name)/Host header?

The apache webserver uses Server Name Indication (SNI) to determine the virtual host (vhost) and with that the Transport Layer Security (TLS) certificate to respond to the TLS handshake. Is the ...
0
votes
0answers
67 views

Hostname provided via SNI and hostname provided via HTTP are different - 400 Bad Request

When a user visits one of our sites they are randomly receiving a 400 Bad Request error. We have 8 domains on this IP. Running Apache 2.4 w/letsencrypt SSL certificates for each domain. We used the ...
0
votes
1answer
198 views

Nginx selective TLS passthrough reverse proxy based on SNI

I have system of IoT devices behind a NAT, so they are not accessible from the public internet (although it's desired). To overcome this I tied them into a VPN, with one member exposed to the public ...
1
vote
1answer
231 views

How to get HAProxy to route TCP based on SNI (using openssl s_client to test)?

I want to use HAProxy to terminate TLS-encrypted TCP connnections and to pass the unencrypted TCP traffic to various backends based on the Server Name Indication used to initiate the TLS connection. ...
0
votes
0answers
30 views

Using SNI with a port specification

I currently have as server with IIS setup as the following: https://default.site.com assigned to port 443 without SNI https://secure.site.com assigned to port 443 with SNI turned on. If browse to ...
2
votes
1answer
47 views

Run 2 SSL servers on 1 debian Pi, both FQDNs,1 Nginx 1 apache, wrong certificate, is this SNI issue?

I'm forced to use Nginx on a.ddns.net and Apache for b.ddns.net (reverse proxy solution too tricky due to established setups). Real server names edited but both verified as resolving to same IP and ...
0
votes
1answer
77 views

Redirect http and non-www using only mod_alias Redirect, dedup SSL configuration?

This is probably a duplicate but I can't find quite what I'm looking for. I'd like to redirect http and/or non-www to https+www. This is often cited as a canonical example of when to avoid mod_rewrite....
1
vote
0answers
59 views

Why is my SSL Cert/IIS Setup not working correctly?

I have 2 domains that are pointed to the same website in IIS 8.5 on Windows Server 2012, domaina.com and domainb.com. Domaina.com is the primary website and domainb.com is the secondary site. Right ...
0
votes
2answers
542 views

Generic SNI-based transparent TLS proxy without having to enumerate all backends?

I'm in a situation where I have to provide a transparent reverse proxy in front of a set of thousands of backend https webservers, with the list changing (relatively) frequently. I know I can tell ...
1
vote
0answers
479 views

F5 SNI Passthrough

G'day all, I'm trying to configure an F5 virtual Big-IP for L4 pass through SNI load balancing, but am having troubles (probably because I'm new to F5's). We have backend websites that require SNI (...
3
votes
1answer
498 views

SNI for a SMTP server

Let's say I have a dedicated server with some IP (IP1). I'm redirecting multiple domains (say example.com, example.net) to that IP via DNS. I've a single nginx server running here, and I've set up SNI ...
0
votes
0answers
148 views

Is it possible to mix SSI and non-SSI bindings, same IP address and port, in IIS 8.5

I found a good resources over at a Microsoft blog which goes into detail about IIS, SNI, and even some CCS: https://blogs.msdn.microsoft.com/kaushal/2012/09/04/server-name-indication-sni-with-iis-8-...
0
votes
1answer
30 views

Apache SNI: Is it possible to mix non-secure hosts with secure hosts on the same interface?

On a shared server, we have some sites that only run on port 80. However, there are other sites that run on both port 80 and 443. For example: <VirtualHost *:80> ServerName unsecure.com </...
0
votes
2answers
1k views

How does HAProxy choose which certificate to serve?

I've got a HAProxy 1.5.9 server that will serve either a certificate signed by a self signed CA or a Let's Encrypt certificate depending on which 'servername' is provided. This is my configuration ...
0
votes
1answer
45 views

What will happen if client call Apache server by IP and there are two SNI virtual hosts [duplicate]

We have a Apache 2.4 web server with a couple of virtual hosts with different certificates. I have set up SNI name based virtualhosts : ap.mmm.com and ac.mmm.com, it's working great. All on same IP (...
0
votes
1answer
872 views

How to split vpn traffic from https traffic on the same port using haproxy?

I have a following goal: Running softhether vpn and web applications both on port 443. I want all traffic to come to haproxy, which sends vpn to one container, and the rest to another container (...
0
votes
1answer
989 views

HAProxy does not perform SNI lookup

HAProxy v.1.5.18, 1.7.11, listening on a single IP address with a wildcard SSL certificate, I need to specify several backends with SNI lookup. There's a ton of config-files that all say req_ssl_sni -...
1
vote
1answer
469 views

How does nginx handle $proxy_host as SNI

Setup: I have an nginx client which is sending a HTTPS request to an nginx origin server. I have been doing my research on how the directive 'proxy_ssl_name' can be used to overwrite the SNI. ...
0
votes
1answer
217 views

HAProxy dynamic server address based off of variable

I want to dynamically route to a server by making use of a request variable ssl_fc_sni. Is it possible to configure haproxy server statement to use a variable for address and/or port? Example backend ...
2
votes
1answer
1k views

Ideal Setup of Apache for multiple SSL certs with SNI on a single IP

I'm looking for the most efficient way to achieve this setup on Apache 2.4.33 in the Amazon Linux Distro: a single server instance (here: AWS EC2) a single associated IP two (or more) domains, each ...
0
votes
1answer
979 views

Apache SNI config to send handshake alert: unrecognized_name

I am trying to achieve what some years ago was a problem due to miss configured servers that caused "handshake alert: unrecognized_name" when a SNI enabled client ( for Java 1.7 or bigger ...
1
vote
1answer
641 views

Apache 2.4 drop connection on default SSL host

I am running Apache 2.4 on Debian serving some SSL websites. My domain name und certificates contain my real name, so I don't want any random user typing in my IP address to get the certificate und my ...
0
votes
0answers
108 views

Support virtualhost routing without SNI support in the client

We are trying to build a TCP proxy that can forward to multiple virtual hosts. The idea is that a single IP address can be used to route inbound requests to multiple internal IP addresses. The initial ...
-1
votes
2answers
72 views

How To Ristrict SSL for one domain in VHOST Apache2 [duplicate]

I have configured Vhost on apache2.it is a name based configuration. First domain is ssl-secure and second one is non ssl-secure site.All are working fine if hit in browser address bar https://www....
5
votes
0answers
445 views

Is it possible to disable clients not supporting SNI in nginx?

By default nginx serves https requests with multiple certificates by using SNI. The fallback for clients not supporting SNI will be the default_server or first vhost which has been configured. I want ...
4
votes
2answers
7k views

No need to enable SNI for multiple SSL sites on same IP but using same wild card certificate?

I have an IIS server hosting: example.com/www.example.com sub1.example.com sub2.example.com They are listed as 3 separate sites under IIS, all bind to the same IP over HTTPS on 443. But they all use ...
1
vote
1answer
923 views

Nginx responds with 200 even when HTTP HOST header is different from SNI

I have just started learning about nginx and SSL and haven beentrying around different configurations. I have two server blocks like the following: server{ listen 443 ssl http2; server_name ...
0
votes
2answers
151 views

Apache Canonical Host with one SSL certificate for with www. and without

Using SNI, there are multiple domains with their own SSL certificates (LetsEncrypt) on one IP address. For one of the primary domains, let's just say https://thedomain.tld, visiting https://www....
3
votes
1answer
860 views

Cloudfront alternate domains using SNI for HTTPS

I am attempting to use Cloudfront to serve an S3 bucket over HTTPS using an "Alternate Domain Name", but I am getting this error when I load the site in a browser: NET::ERR_CERT_COMMON_NAME_INVALID ...
6
votes
1answer
4k views

HTTP status code to signal bad or missing Host header

Is there an HTTP status code which is appropriate to use for clients which send a bad hostname (or none at all) through SNI or the HTTP Host header? An older question address how and why such ...
3
votes
1answer
2k views

How to check haproxy sni-based rule with curl?

I made simple HaProxy configuration to pass thorough traffic based on SNI field. Here is my haproxy.cfg defaults log global timeout client 50s timeout client-fin 50s timeout connect ...
0
votes
3answers
2k views

Dockerized Nginx + Certbot + tls-sni challenge not working on renewal

I have an existing service running using docker containers: nginx (nginx:1.13.5) node-api (node container) node-website (node container) I wanted to add SSL certificates for both api and website. So ...
8
votes
2answers
1k views

How do I setup multiple subdomains with their own certificate using nginx?

Unless every answer that I've read was plain wrong, SNI should make it possible to do what I want, yet every guide tells me to do exactly what I'm doing. And yet nginx is serving the wrong ...
1
vote
1answer
415 views

How do you quickly test to see if a user-agent supports Server Name Indication (SNI)?

There used to be a handy site http://sni.velox.ch that'd quickly tell you if your browser or a proxy along the way was preventing you sending an SNI header. I have an IoT device which I can cause to ...
2
votes
1answer
11k views

easy_install and pip fail with SSL warnings

I'm looking after some RHEL6 servers and trying to set them up to use an internal PyPi server (proxied by Nexus 3). The problem is that our internal PyPi server is one of several SSL VHosts on the ...
0
votes
1answer
2k views

Sni multiple ssl on different virtualhosts Apache 2.4.10 (Debian)

Is it possible to set up multiple domains ssl on that apache version? I have site A -> ssl certificate A site B -> certificate B then each file has a virtualhost like this, but it's not working: ...
1
vote
1answer
918 views

Apache SNI Issues with SSL Certificates

I'm having issues with my VirtualHost configurations on my server. My server is running Ubuntu 14.04.5 LTS (GNU/Linux 4.4.0-31-generic x86_64), with Apache/2.4.7 (Ubuntu). I've done a lot of reading ...
3
votes
1answer
7k views

How to check apache for SNI (Server Name Indication ) availability?

I have a centos 7 server. I switched from apache 2.4.6 to apache 2.4.25 using IUS repository (https://ius.io/). My goal is to support multiple SSL certificates with a single IP. I have installed: ...
1
vote
1answer
686 views

SNI for Multiple Hosts on Lighttpd

Inherited lighttpd server, I'm somewhat clueless on it. Trying to use SNI to install a 3rd SSL cert without another IP. Currently the SSL config in lighttpd.conf looks like so: $SERVER["socket"] == ":...
1
vote
1answer
844 views

TLS/SSL - Does SNI Have a Limit on Number of Domains Running on Nginx?

SNI (Server Name Indication) is an extension to the TLS/SSL protocol, allowing the webserver to serve multiple domains on the same IP, all with different SSL server certificates. SNI discovers the ...
0
votes
1answer
374 views

Can I configure IIS to listen to many, yet different cipher configurations of TLS?

I need to programmatically determine the TLS features of a client and underlying host based on Javascript. What webserver instance (apache, IIS, etc), allows for different configurations of SSL ...
0
votes
1answer
491 views

Redirect all nginx traffic to SSL except one single php

I have a prestashop site which is all in SSL. The problem I have is that the paymemnt gateway return is unable to do it with SSL, so I have to create an exception on my nginx config to accept the ...
0
votes
1answer
243 views

LetsEncrypt and other CA mixed in Apache2.2 “overlap”

seems like i can't get another SSL-Certificate on my maschine running. I work on an Apache 2.2 and we got a domain with an SSLCertificate, signed by GlobalSign. Now i wanted to add another ...
1
vote
2answers
1k views

Use virtual host certificate

I'm trying to enable SSL in name-based virtual hosts. From docs I understand that SNI does not need to be enabled explicitly, it happens automatically if both server and client comply with minimum ...