Questions tagged [sni]
Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address
189
questions
-3
votes
0
answers
29
views
I have Unlimited Netflix Plan from my ISP. I want to spoof Netflix traffic and browse other web sites [closed]
I have Unlimited Netflix Plan from ISP. I want to spoof Netflix traffic and browse other web sites. How to do this? I already have openwrt rother with me and a server in remote location.
0
votes
1
answer
38
views
How to get a secure HTTP monitor in NetScaler to send SNI in its request?
We have a content switch in front of a virtual server in NetScaler ADC, and it acts as a load balancer. It is tied to a service group that has an HTTP monitor. We cannot get this monitor to work.
The ...
0
votes
1
answer
42
views
How to run nginx and ocserv on the same IP:Port using the same domain name?
How to run nginx and ocserv on the same IP:Port using the same domain name? Just like how a similar thing is possible by using SSTP protocol, if I am not mistaken. I am using Ubuntu 20.04.
- 48
1
vote
1
answer
78
views
How to use AD CS to auto-renew certs for securing IIS websites that use SNI?
I have AD CS which automatically provisions and renews machine certificates for servers bound to the directory. (There is a certificate template which controls this auto-issuance.)
I have an IIS ...
- 484
1
vote
2
answers
209
views
Linux netfilter NAT based on SNI?
I am trying to do SNI proxying to a subnet on a router while keeping the src IP.
Background: I have a router doing DNAT to do port-forwarding for many application ports, and it is connected to a ...
- 13
1
vote
1
answer
209
views
SSL alternative names mismatch
Santander want to use our website, however when trying to access it they receive the following error:
'Network Error: Your request contacted a host which presented a certificate signed by an untrusted ...
- 11
1
vote
1
answer
136
views
Getting AH02032 using TLSv1.2 despite identical SNI server name and Hostname, but SNI has the port number attached. No error in test env. with TLSv1.3
Getting the the error message below despite identical Hostnames. What I don't understand, why the Hostname provided via SNI has the port number attached even though, according to Hostname ...
1
vote
0
answers
418
views
Envoy to envoy TLS for TLS proxy
Assume this artitecture
................................................
. .
...
1
vote
1
answer
465
views
Why is "tcp-request content accept" frontend instruction is required for proper HAProxy SNI-based routing?
I've recently tried to set up SNI-based routing on HAProxy for mongodb mongodb+srv protocol connection.
I made it working, but it wasn't until I put
tcp-request inspect-delay 5s
tcp-request content ...
- 41
0
votes
1
answer
169
views
IIS 10 2 domains with SSLs on same IP - SNI checked for both but 1 of them still doesnt work
Using fictional domains here instead of the actual ones I have this situation:
domain1.com has binding set up in IIS and is linked to SSL and has "Require Server Name Indication" checked.
...
- 113
0
votes
2
answers
477
views
SSL Certificate not valid on SNI server - Dovecot/Postfix
I've got a Dovecot/Postfix server running on a Raspberry Pi running Raspbian 10 (Buster) I have two domain names running on the same server which for privacy I'll call DOMAIN 1 and DOMAIN 2. Both have ...
1
vote
1
answer
144
views
Can there be a "TLS Passthrough based on SNI" version of CloudFlare's "orange-cloud"?
My understanding is that the "orange-cloud" [1] is a TLS terminating reverse proxy. Multiple upstream servers share the same Cloudflare Anycast IP. A TLS connection is formed between the ...
- 11
0
votes
1
answer
988
views
How does a TLS Passthrough reverse proxy based on SNI work?
There are various articles and questions explaining how to use a given reverse proxy's (e.g. nginx) implementation of this [1] [2] [3] [4], but none explain how this actually works under the hood.
By &...
- 11
1
vote
1
answer
1k
views
HAProxy is not working with SNI and ACLs
I am trying to get haproxy to use acls with SNI and it ain't cooperating. It presents the correct cert so SNI must be working. However, I cannot get it to select a backend based on the hostname in ...
- 51
0
votes
1
answer
2k
views
HAPROXY SNI SSL pass through or termination
I would like to set up HAProxy to terminate SSL or pass through connection depends from hostname, exposing only one public IP address. For example
Internet -> domain web1.example.com (10.10.10.1) ...
- 1
0
votes
0
answers
2k
views
SNI header missing from TLS Client Hello when using HTTP proxy
I'm debugging a problem with a Java-based application that retrieves a JSON payload (the CVE list from NIST) over HTTPS. When I connect directly to NIST, I retrieve the data successfully. When I use ...
- 101
1
vote
0
answers
423
views
IIS serves wrong cert using SNI or CCS
I have 3 websites all using the same IP in IIS 10. I first setup the https bindings to use SNI with 'all assigned' IP addresses on port 443 using the correct certificate. All the certs are known good. ...
- 73
0
votes
1
answer
1k
views
How to force a specific routing based on SNI in HAProxy?
I have the following HAProxy configuration:
listen sni-443
bind *:443
mode tcp
timeout connect 4s
timeout client 3m
timeout server 3m
tcp-request inspect-delay 5s
tcp-...
- 266
-1
votes
1
answer
120
views
What is SNI (with specific reference to Plivo)
Plivo have announced that they are depreciating their Legacy Messaging API for SNI. I've been unable to find any documentation on the topic (ideally with code samples) on their portal.
I'm not been ...
- 141
0
votes
0
answers
218
views
Disable SNI on Apache
I've a Windows Server 2016 installed with Apache 2.4.37
In the Apache server, I've setup multiple virtual host like:
abc.host.com
def.host.com
ghi.host.com
All this virtual host share the same IP ...
- 3
0
votes
1
answer
1k
views
select an haproxy tcp back end depending on source ip
I have basic haproxy knowledge and know how to handle the selection of tcp backends depending on the SNI server name.
The relevant lines are
acl is_myhost req.ssl_sni -i my.host.com
acl ...
- 227
1
vote
0
answers
69
views
AWS Elastic Beanstalk SNI SSL in S3
In our application we need to support customer ssl certificates and domains.
Application stack: AWS Elastic Beanstalk, NodeJs and nginx server.
I've found that we can use nginx variable "$...
- 11
0
votes
2
answers
6k
views
Nginx: How to combine ssl_preread_protocol with ssl_preread_server_name (ssh-multiplexing and ssl-sni-passthrough)?
I have the nginx.conf file shown below.
I want to run both ssh and a webserver on port 443/SSL.
Also known as SSL-port-multiplexing.
At the same time, I want to use ssl-passthrough with SNI.
For ssh-...
- 1,004
2
votes
1
answer
4k
views
Nginx and https - Specifying an ip address as a server_name gives the correct website but the wrong certificate
I want to run this url: https://192.168.1.254 and get a website with the correct content and certificate in the address bar. I am getting the website but I get an invalid certificate error in the ...
- 193
0
votes
1
answer
433
views
nginx behind haproxy - pages randomly loading regardles of submited domain
I currently have one web server (10.0.0.77) running nginx with multipple vhosts (couple of wordpress sites and nextcloud installation) all running on 1 IP address and everything is secured with a ...
- 159
1
vote
1
answer
3k
views
HAProxy: SSL Termination with exception for a specific domain Wildcard SSL-Certificate request
I am new to HAProxy and got most parts working as expected. The current setup is: If I add a new site to one of the balanced (behind the LB) servers, the certificate is issued and served by the Load ...
- 13
1
vote
1
answer
926
views
ldapsearch fails on centos8 with Google LDAPS but works on Ubuntu 20.04 with work around
My end goal is to use sssd and Google LDAPS but can tell if things will work with ldapsearch. Google LDAPS requires the Server Name Indication (SNI) extension. I have it working on Ubuntu 20.04 with a ...
- 201
0
votes
1
answer
783
views
Postfix SSL USING SNI
I What to give assign multiple SSL cert to Multiple Domains
I have manage to do so :
by creating a single wild card SSL cert (e.g mail.example.com , mail.example2.com, etc)
But I Want Each domain to ...
- 3
0
votes
1
answer
247
views
SNI in pure-ftpd
I'm looking for SNI support in pure-ftpd. I found some documentation here: https://download.pureftpd.org/pub/pure-ftpd/doc/README.TLS
Please read section CUSTOM CERTIFICATE HANDLERS in the above link. ...
1
vote
1
answer
1k
views
Nginx upstream keepalive with SNI
I've got Nginx setup to proxy two subdomains. SNI is used so each subdomain has a different SSL certificate. Nginx setup is roughly:
upstream a_example_443 {
server 1.2.3.4:443;
keepalive 128;
...
- 184
3
votes
1
answer
9k
views
AWS ALB/NLB HTTPS Target with Self-Signed Cert
I am using AWS to build a service. For this service I want to use ACM certificates. The backend is running on an EC2 instance with TLS enabled using a self-signed certificate. Since ACM certificates ...
- 151
1
vote
0
answers
666
views
SNI fails on nginx - wrong cert being issued
I've been testing my various websites security at Qualsys. All my sites run off of one nginx host. The sites work fine and get an A+ on the Qualsys tests. The only issue that I really want to fix is ...
- 11
1
vote
0
answers
139
views
Logging source IP for connection through SNI proxy
I'm using a simple SNI proxy (slt) to forward HTTPS to the correct virtual machine without terminating SSL in the proxy.
Something that is glaringly obvious in hindsight: there is no way for me to ...
- 3,287
1
vote
1
answer
231
views
https with sni two certs tho server names but same config. can I use one server block?
I often encounter following problem.
I have an nginx server serving two hostnames via https on the same IP and the same port. Each host name has it's own cert.
What I am doing so far is to have two ...
- 227
1
vote
1
answer
3k
views
Nginx selective TLS passthrough reverse proxy based on SNI
I have system of IoT devices behind a NAT, so they are not accessible from the public internet (although it's desired).
To overcome this I tied them into a VPN, with one member exposed to the public ...
4
votes
1
answer
13k
views
How to get HAProxy to route TCP based on SNI (using openssl s_client to test)?
I want to use HAProxy to terminate TLS-encrypted TCP connnections and to pass the unencrypted TCP traffic to various backends based on the Server Name Indication used to initiate the TLS connection.
...
- 263
2
votes
1
answer
145
views
Run 2 SSL servers on 1 debian Pi, both FQDNs,1 Nginx 1 apache, wrong certificate, is this SNI issue?
I'm forced to use Nginx on a.ddns.net and Apache for b.ddns.net (reverse proxy solution too tricky due to established setups). Real server names edited but both verified as resolving to same IP and ...
- 21
0
votes
1
answer
172
views
Redirect http and non-www using only mod_alias Redirect, dedup SSL configuration?
This is probably a duplicate but I can't find quite what I'm looking for. I'd like to redirect http and/or non-www to https+www. This is often cited as a canonical example of when to avoid mod_rewrite....
- 1
1
vote
0
answers
93
views
Why is my SSL Cert/IIS Setup not working correctly?
I have 2 domains that are pointed to the same website in IIS 8.5 on Windows Server 2012, domaina.com and domainb.com.
Domaina.com is the primary website and domainb.com is the secondary site. Right ...
- 111
0
votes
2
answers
2k
views
Generic SNI-based transparent TLS proxy without having to enumerate all backends?
I'm in a situation where I have to provide a transparent reverse proxy in front of a set of thousands of backend https webservers, with the list changing (relatively) frequently.
I know I can tell ...
- 651
1
vote
0
answers
2k
views
F5 SNI Passthrough
G'day all,
I'm trying to configure an F5 virtual Big-IP for L4 pass through SNI load balancing, but am having troubles (probably because I'm new to F5's).
We have backend websites that require SNI (...
- 11
7
votes
1
answer
2k
views
SNI for a SMTP server
Let's say I have a dedicated server with some IP (IP1). I'm redirecting multiple domains (say example.com, example.net) to that IP via DNS.
I've a single nginx server running here, and I've set up SNI ...
- 228
1
vote
0
answers
573
views
Is it possible to mix SSI and non-SSI bindings, same IP address and port, in IIS 8.5
I found a good resources over at a Microsoft blog which goes into detail about IIS, SNI, and even some CCS:
https://blogs.msdn.microsoft.com/kaushal/2012/09/04/server-name-indication-sni-with-iis-8-...
- 161
0
votes
1
answer
102
views
Apache SNI: Is it possible to mix non-secure hosts with secure hosts on the same interface?
On a shared server, we have some sites that only run on port 80. However, there are other sites that run on both port 80 and 443.
For example:
<VirtualHost *:80>
ServerName unsecure.com
</...
- 103
1
vote
2
answers
4k
views
How does HAProxy choose which certificate to serve?
I've got a HAProxy 1.5.9 server that will serve either a certificate signed by a self signed CA or a Let's Encrypt certificate depending on which 'servername' is provided. This is my configuration ...
- 4,640
0
votes
1
answer
265
views
What will happen if client call Apache server by IP and there are two SNI virtual hosts [duplicate]
We have a Apache 2.4 web server with a couple of virtual hosts with different certificates.
I have set up SNI name based virtualhosts : ap.mmm.com and ac.mmm.com, it's working great. All on same IP (...
- 49
0
votes
1
answer
2k
views
How to split vpn traffic from https traffic on the same port using haproxy?
I have a following goal:
Running softhether vpn and web applications both on port 443. I want all traffic to come to haproxy, which sends vpn to one container, and the rest to another container (...
0
votes
1
answer
3k
views
HAProxy does not perform SNI lookup
HAProxy v.1.5.18, 1.7.11, listening on a single IP address with a wildcard SSL certificate, I need to specify several backends with SNI lookup. There's a ton of config-files that all say req_ssl_sni -...
- 774
1
vote
1
answer
896
views
How does nginx handle $proxy_host as SNI
Setup: I have an nginx client which is sending a HTTPS request to an nginx origin server.
I have been doing my research on how the directive 'proxy_ssl_name' can be used to overwrite the SNI. ...
- 25
1
vote
1
answer
509
views
HAProxy dynamic server address based off of variable
I want to dynamically route to a server by making use of a request variable ssl_fc_sni. Is it possible to configure haproxy server statement to use a variable for address and/or port?
Example
backend ...
- 11