Questions tagged [sni]

Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address

Filter by
Sorted by
Tagged with
1 vote
1 answer
268 views

HAProxy is not working with SNI and ACLs

I am trying to get haproxy to use acls with SNI and it ain't cooperating. It presents the correct cert so SNI must be working. However, I cannot get it to select a backend based on the hostname in ...
user avatar
0 votes
1 answer
421 views

HAPROXY SNI SSL pass through or termination

I would like to set up HAProxy to terminate SSL or pass through connection depends from hostname, exposing only one public IP address. For example Internet -> domain web1.example.com (10.10.10.1) ...
user avatar
0 votes
0 answers
541 views

SNI header missing from TLS Client Hello when using HTTP proxy

I'm debugging a problem with a Java-based application that retrieves a JSON payload (the CVE list from NIST) over HTTPS. When I connect directly to NIST, I retrieve the data successfully. When I use ...
user avatar
0 votes
0 answers
139 views

IIS 10 - Https with wildcard doesn't serve the good certificate (SNI)

I have only two IIS Site : subdomain.domain1.com subdomain.domain2.com And two certificates : subdomain.domain1.com one standard *.domain2.com one wildcard For some strange reason, the site with ...
user avatar
  • 101
1 vote
0 answers
171 views

IIS serves wrong cert using SNI or CCS

I have 3 websites all using the same IP in IIS 10. I first setup the https bindings to use SNI with 'all assigned' IP addresses on port 443 using the correct certificate. All the certs are known good. ...
user avatar
  • 73
0 votes
1 answer
308 views

How to force a specific routing based on SNI in HAProxy?

I have the following HAProxy configuration: listen sni-443 bind *:443 mode tcp timeout connect 4s timeout client 3m timeout server 3m tcp-request inspect-delay 5s tcp-...
user avatar
-1 votes
1 answer
83 views

What is SNI (with specific reference to Plivo)

Plivo have announced that they are depreciating their Legacy Messaging API for SNI. I've been unable to find any documentation on the topic (ideally with code samples) on their portal. I'm not been ...
user avatar
  • 141
0 votes
0 answers
116 views

Nginx proxy_pass to server with different name/certificate

I've got a number of upstreams that I proxy requests to in an nginx reverse-proxy setup. Each of these has their own domain names and certificates to match. After turning on proxy_ssl_verify in my ...
user avatar
  • 121
0 votes
0 answers
103 views

Disable SNI on Apache

I've a Windows Server 2016 installed with Apache 2.4.37 In the Apache server, I've setup multiple virtual host like: abc.host.com def.host.com ghi.host.com All this virtual host share the same IP ...
user avatar
0 votes
1 answer
414 views

select an haproxy tcp back end depending on source ip

I have basic haproxy knowledge and know how to handle the selection of tcp backends depending on the SNI server name. The relevant lines are acl is_myhost req.ssl_sni -i my.host.com acl ...
user avatar
  • 203
1 vote
0 answers
37 views

AWS Elastic Beanstalk SNI SSL in S3

In our application we need to support customer ssl certificates and domains. Application stack: AWS Elastic Beanstalk, NodeJs and nginx server. I've found that we can use nginx variable "$...
user avatar
0 votes
2 answers
3k views

Nginx: How to combine ssl_preread_protocol with ssl_preread_server_name (ssh-multiplexing and ssl-sni-passthrough)?

I have the nginx.conf file shown below. I want to run both ssh and a webserver on port 443/SSL. Also known as SSL-port-multiplexing. At the same time, I want to use ssl-passthrough with SNI. For ssh-...
user avatar
  • 974
2 votes
1 answer
1k views

Nginx and https - Specifying an ip address as a server_name gives the correct website but the wrong certificate

I want to run this url: https://192.168.1.254 and get a website with the correct content and certificate in the address bar. I am getting the website but I get an invalid certificate error in the ...
user avatar
0 votes
1 answer
198 views

nginx behind haproxy - pages randomly loading regardles of submited domain

I currently have one web server (10.0.0.77) running nginx with multipple vhosts (couple of wordpress sites and nextcloud installation) all running on 1 IP address and everything is secured with a ...
user avatar
  • 159
1 vote
1 answer
2k views

HAProxy: SSL Termination with exception for a specific domain Wildcard SSL-Certificate request

I am new to HAProxy and got most parts working as expected. The current setup is: If I add a new site to one of the balanced (behind the LB) servers, the certificate is issued and served by the Load ...
user avatar
  • 13
0 votes
1 answer
662 views

ldapsearch fails on centos8 with Google LDAPS but works on Ubuntu 20.04 with work around

My end goal is to use sssd and Google LDAPS but can tell if things will work with ldapsearch. Google LDAPS requires the Server Name Indication (SNI) extension. I have it working on Ubuntu 20.04 with a ...
user avatar
  • 181
0 votes
1 answer
577 views

Postfix SSL USING SNI

I What to give assign multiple SSL cert to Multiple Domains I have manage to do so : by creating a single wild card SSL cert (e.g mail.example.com , mail.example2.com, etc) But I Want Each domain to ...
user avatar
  • 3
0 votes
1 answer
186 views

SNI in pure-ftpd

I'm looking for SNI support in pure-ftpd. I found some documentation here: https://download.pureftpd.org/pub/pure-ftpd/doc/README.TLS Please read section CUSTOM CERTIFICATE HANDLERS in the above link. ...
user avatar
1 vote
1 answer
789 views

Nginx upstream keepalive with SNI

I've got Nginx setup to proxy two subdomains. SNI is used so each subdomain has a different SSL certificate. Nginx setup is roughly: upstream a_example_443 { server 1.2.3.4:443; keepalive 128; ...
user avatar
  • 184
3 votes
1 answer
6k views

AWS ALB/NLB HTTPS Target with Self-Signed Cert

I am using AWS to build a service. For this service I want to use ACM certificates. The backend is running on an EC2 instance with TLS enabled using a self-signed certificate. Since ACM certificates ...
user avatar
1 vote
0 answers
432 views

SNI fails on nginx - wrong cert being issued

I've been testing my various websites security at Qualsys. All my sites run off of one nginx host. The sites work fine and get an A+ on the Qualsys tests. The only issue that I really want to fix is ...
user avatar
1 vote
0 answers
78 views

Logging source IP for connection through SNI proxy

I'm using a simple SNI proxy (slt) to forward HTTPS to the correct virtual machine without terminating SSL in the proxy. Something that is glaringly obvious in hindsight: there is no way for me to ...
user avatar
1 vote
1 answer
156 views

https with sni two certs tho server names but same config. can I use one server block?

I often encounter following problem. I have an nginx server serving two hostnames via https on the same IP and the same port. Each host name has it's own cert. What I am doing so far is to have two ...
user avatar
  • 203
1 vote
1 answer
2k views

Nginx selective TLS passthrough reverse proxy based on SNI

I have system of IoT devices behind a NAT, so they are not accessible from the public internet (although it's desired). To overcome this I tied them into a VPN, with one member exposed to the public ...
user avatar
2 votes
1 answer
8k views

How to get HAProxy to route TCP based on SNI (using openssl s_client to test)?

I want to use HAProxy to terminate TLS-encrypted TCP connnections and to pass the unencrypted TCP traffic to various backends based on the Server Name Indication used to initiate the TLS connection. ...
user avatar
  • 223
2 votes
1 answer
120 views

Run 2 SSL servers on 1 debian Pi, both FQDNs,1 Nginx 1 apache, wrong certificate, is this SNI issue?

I'm forced to use Nginx on a.ddns.net and Apache for b.ddns.net (reverse proxy solution too tricky due to established setups). Real server names edited but both verified as resolving to same IP and ...
user avatar
0 votes
1 answer
127 views

Redirect http and non-www using only mod_alias Redirect, dedup SSL configuration?

This is probably a duplicate but I can't find quite what I'm looking for. I'd like to redirect http and/or non-www to https+www. This is often cited as a canonical example of when to avoid mod_rewrite....
user avatar
  • 1
1 vote
0 answers
92 views

Why is my SSL Cert/IIS Setup not working correctly?

I have 2 domains that are pointed to the same website in IIS 8.5 on Windows Server 2012, domaina.com and domainb.com. Domaina.com is the primary website and domainb.com is the secondary site. Right ...
user avatar
0 votes
2 answers
2k views

Generic SNI-based transparent TLS proxy without having to enumerate all backends?

I'm in a situation where I have to provide a transparent reverse proxy in front of a set of thousands of backend https webservers, with the list changing (relatively) frequently. I know I can tell ...
user avatar
1 vote
0 answers
1k views

F5 SNI Passthrough

G'day all, I'm trying to configure an F5 virtual Big-IP for L4 pass through SNI load balancing, but am having troubles (probably because I'm new to F5's). We have backend websites that require SNI (...
user avatar
  • 11
6 votes
1 answer
1k views

SNI for a SMTP server

Let's say I have a dedicated server with some IP (IP1). I'm redirecting multiple domains (say example.com, example.net) to that IP via DNS. I've a single nginx server running here, and I've set up SNI ...
user avatar
  • 218
1 vote
0 answers
464 views

Is it possible to mix SSI and non-SSI bindings, same IP address and port, in IIS 8.5

I found a good resources over at a Microsoft blog which goes into detail about IIS, SNI, and even some CCS: https://blogs.msdn.microsoft.com/kaushal/2012/09/04/server-name-indication-sni-with-iis-8-...
user avatar
0 votes
1 answer
57 views

Apache SNI: Is it possible to mix non-secure hosts with secure hosts on the same interface?

On a shared server, we have some sites that only run on port 80. However, there are other sites that run on both port 80 and 443. For example: <VirtualHost *:80> ServerName unsecure.com </...
user avatar
  • 103
1 vote
2 answers
3k views

How does HAProxy choose which certificate to serve?

I've got a HAProxy 1.5.9 server that will serve either a certificate signed by a self signed CA or a Let's Encrypt certificate depending on which 'servername' is provided. This is my configuration ...
user avatar
0 votes
1 answer
161 views

What will happen if client call Apache server by IP and there are two SNI virtual hosts [duplicate]

We have a Apache 2.4 web server with a couple of virtual hosts with different certificates. I have set up SNI name based virtualhosts : ap.mmm.com and ac.mmm.com, it's working great. All on same IP (...
user avatar
0 votes
1 answer
2k views

How to split vpn traffic from https traffic on the same port using haproxy?

I have a following goal: Running softhether vpn and web applications both on port 443. I want all traffic to come to haproxy, which sends vpn to one container, and the rest to another container (...
user avatar
0 votes
1 answer
3k views

HAProxy does not perform SNI lookup

HAProxy v.1.5.18, 1.7.11, listening on a single IP address with a wildcard SSL certificate, I need to specify several backends with SNI lookup. There's a ton of config-files that all say req_ssl_sni -...
user avatar
  • 744
1 vote
1 answer
768 views

How does nginx handle $proxy_host as SNI

Setup: I have an nginx client which is sending a HTTPS request to an nginx origin server. I have been doing my research on how the directive 'proxy_ssl_name' can be used to overwrite the SNI. ...
user avatar
  • 25
1 vote
1 answer
444 views

HAProxy dynamic server address based off of variable

I want to dynamically route to a server by making use of a request variable ssl_fc_sni. Is it possible to configure haproxy server statement to use a variable for address and/or port? Example backend ...
user avatar
  • 11
2 votes
1 answer
2k views

Ideal Setup of Apache for multiple SSL certs with SNI on a single IP

I'm looking for the most efficient way to achieve this setup on Apache 2.4.33 in the Amazon Linux Distro: a single server instance (here: AWS EC2) a single associated IP two (or more) domains, each ...
user avatar
  • 143
0 votes
1 answer
2k views

Apache SNI config to send handshake alert: unrecognized_name

I am trying to achieve what some years ago was a problem due to miss configured servers that caused "handshake alert: unrecognized_name" when a SNI enabled client ( for Java 1.7 or bigger ...
user avatar
1 vote
1 answer
1k views

Apache 2.4 drop connection on default SSL host

I am running Apache 2.4 on Debian serving some SSL websites. My domain name und certificates contain my real name, so I don't want any random user typing in my IP address to get the certificate und my ...
user avatar
0 votes
0 answers
199 views

Support virtualhost routing without SNI support in the client

We are trying to build a TCP proxy that can forward to multiple virtual hosts. The idea is that a single IP address can be used to route inbound requests to multiple internal IP addresses. The initial ...
user avatar
  • 121
-1 votes
2 answers
73 views

How To Ristrict SSL for one domain in VHOST Apache2 [duplicate]

I have configured Vhost on apache2.it is a name based configuration. First domain is ssl-secure and second one is non ssl-secure site.All are working fine if hit in browser address bar https://www....
user avatar
5 votes
1 answer
1k views

Is it possible to disable clients not supporting SNI in nginx?

By default nginx serves https requests with multiple certificates by using SNI. The fallback for clients not supporting SNI will be the default_server or first vhost which has been configured. I want ...
user avatar
  • 183
7 votes
2 answers
18k views

No need to enable SNI for multiple SSL sites on same IP but using same wild card certificate?

I have an IIS server hosting: example.com/www.example.com sub1.example.com sub2.example.com They are listed as 3 separate sites under IIS, all bind to the same IP over HTTPS on 443. But they all use ...
user avatar
1 vote
1 answer
2k views

Nginx responds with 200 even when HTTP HOST header is different from SNI

I have just started learning about nginx and SSL and haven beentrying around different configurations. I have two server blocks like the following: server{ listen 443 ssl http2; server_name ...
user avatar
  • 25
0 votes
2 answers
232 views

Apache Canonical Host with one SSL certificate for with www. and without

Using SNI, there are multiple domains with their own SSL certificates (LetsEncrypt) on one IP address. For one of the primary domains, let's just say https://thedomain.tld, visiting https://www....
user avatar
3 votes
1 answer
2k views

Cloudfront alternate domains using SNI for HTTPS

I am attempting to use Cloudfront to serve an S3 bucket over HTTPS using an "Alternate Domain Name", but I am getting this error when I load the site in a browser: NET::ERR_CERT_COMMON_NAME_INVALID ...
user avatar
  • 295
6 votes
1 answer
9k views

HTTP status code to signal bad or missing Host header

Is there an HTTP status code which is appropriate to use for clients which send a bad hostname (or none at all) through SNI or the HTTP Host header? An older question address how and why such ...
user avatar
  • 29.7k