Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sni]

Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address

0
votes
1answer
23 views

Apache SNI: Is it possible to mix non-secure hosts with secure hosts on the same interface?

On a shared server, we have some sites that only run on port 80. However, there are other sites that run on both port 80 and 443. For example: <VirtualHost *:80> ServerName unsecure.com </...
0
votes
2answers
26 views

How does HAProxy choose which certificate to serve?

I've got a HAProxy 1.5.9 server that will serve either a certificate signed by a self signed CA or a Let's Encrypt certificate depending on which 'servername' is provided. This is my configuration ...
0
votes
1answer
23 views

What will happen if client call Apache server by IP and there are two SNI virtual hosts [duplicate]

We have a Apache 2.4 web server with a couple of virtual hosts with different certificates. I have set up SNI name based virtualhosts : ap.mmm.com and ac.mmm.com, it's working great. All on same IP (...
0
votes
0answers
28 views

Apache SSL and non SSL sites VirtualHosts not working correctly

Server config: CentOS 7.4 mod_ssl installed Apache 2.4.6 site1.com and site2.de both point to the ip 1.2.3.4. site1.com is non-SSL-driven (temporarily for Let's Encrypt ACME-challenge - will be ...
0
votes
0answers
24 views

Enforce SNI on https bindings

An SSL binding was added in IIS recently for a website on our shared server, but the SNI box was mistakenly not checked. This caused certificate errors to be displayed for all other websites on the ...
0
votes
1answer
180 views

How to split vpn traffic from https traffic on the same port using haproxy?

I have a following goal: Running softhether vpn and web applications both on port 443. I want all traffic to come to haproxy, which sends vpn to one container, and the rest to another container (...
0
votes
1answer
279 views

HAProxy does not perform SNI lookup

HAProxy v.1.5.18, 1.7.11, listening on a single IP address with a wildcard SSL certificate, I need to specify several backends with SNI lookup. There's a ton of config-files that all say req_ssl_sni -...
1
vote
1answer
90 views

How does nginx handle $proxy_host as SNI

Setup: I have an nginx client which is sending a HTTPS request to an nginx origin server. I have been doing my research on how the directive 'proxy_ssl_name' can be used to overwrite the SNI. ...
0
votes
1answer
87 views

HAProxy dynamic server address based off of variable

I want to dynamically route to a server by making use of a request variable ssl_fc_sni. Is it possible to configure haproxy server statement to use a variable for address and/or port? Example backend ...
1
vote
1answer
311 views

Ideal Setup of Apache for multiple SSL certs with SNI on a single IP

I'm looking for the most efficient way to achieve this setup on Apache 2.4.33 in the Amazon Linux Distro: a single server instance (here: AWS EC2) a single associated IP two (or more) domains, each ...
0
votes
1answer
368 views

Apache SNI config to send handshake alert: unrecognized_name

I am trying to achieve what some years ago was a problem due to miss configured servers that caused "handshake alert: unrecognized_name" when a SNI enabled client ( for Java 1.7 or bigger ...
0
votes
1answer
276 views

Apache 2.4 drop connection on default SSL host

I am running Apache 2.4 on Debian serving some SSL websites. My domain name und certificates contain my real name, so I don't want any random user typing in my IP address to get the certificate und my ...
0
votes
0answers
49 views

Support virtualhost routing without SNI support in the client

We are trying to build a TCP proxy that can forward to multiple virtual hosts. The idea is that a single IP address can be used to route inbound requests to multiple internal IP addresses. The initial ...
0
votes
0answers
154 views

How to hide/delete No SNI Certificate in Nginx?

I have 2 domains hi.com and hello.com using one IP 234.235.236.237 If I check domain hi.com in ssllabs.com I see 1 certificate, nice. But, if I check domain hello.com in ssllabs.com I see 2 ...
-1
votes
2answers
67 views

How To Ristrict SSL for one domain in VHOST Apache2 [duplicate]

I have configured Vhost on apache2.it is a name based configuration. First domain is ssl-secure and second one is non ssl-secure site.All are working fine if hit in browser address bar https://www....
2
votes
0answers
220 views

Is it possible to disable clients not supporting SNI in nginx?

By default nginx serves https requests with multiple certificates by using SNI. The fallback for clients not supporting SNI will be the default_server or first vhost which has been configured. I want ...
2
votes
2answers
1k views

No need to enable SNI for multiple SSL sites on same IP but using same wild card certificate?

I have an IIS server hosting: example.com/www.example.com sub1.example.com sub2.example.com They are listed as 3 separate sites under IIS, all bind to the same IP over HTTPS on 443. But they all use ...
0
votes
0answers
454 views

IIS10, SNI and two default SSL sites on two IP addresses. Binding issue

We have two IP addresses with two SSL sites on each of them. 4 sites (and 4 certificates) in total. Everything works fine (unless client does not support SNI). I want to have two "default" SSL sites (...
1
vote
1answer
524 views

Nginx responds with 200 even when HTTP HOST header is different from SNI

I have just started learning about nginx and SSL and haven beentrying around different configurations. I have two server blocks like the following: server{ listen 443 ssl http2; server_name ...
0
votes
2answers
100 views

Apache Canonical Host with one SSL certificate for with www. and without

Using SNI, there are multiple domains with their own SSL certificates (LetsEncrypt) on one IP address. For one of the primary domains, let's just say https://thedomain.tld, visiting https://www....
2
votes
1answer
382 views

Cloudfront alternate domains using SNI for HTTPS

I am attempting to use Cloudfront to serve an S3 bucket over HTTPS using an "Alternate Domain Name", but I am getting this error when I load the site in a browser: NET::ERR_CERT_COMMON_NAME_INVALID ...
6
votes
1answer
2k views

HTTP status code to signal bad or missing Host header

Is there an HTTP status code which is appropriate to use for clients which send a bad hostname (or none at all) through SNI or the HTTP Host header? An older question address how and why such ...
3
votes
1answer
1k views

How to check haproxy sni-based rule with curl?

I made simple HaProxy configuration to pass thorough traffic based on SNI field. Here is my haproxy.cfg defaults log global timeout client 50s timeout client-fin 50s timeout connect ...
0
votes
3answers
1k views

Dockerized Nginx + Certbot + tls-sni challenge not working on renewal

I have an existing service running using docker containers: nginx (nginx:1.13.5) node-api (node container) node-website (node container) I wanted to add SSL certificates for both api and website. So ...
8
votes
2answers
792 views

How do I setup multiple subdomains with their own certificate using nginx?

Unless every answer that I've read was plain wrong, SNI should make it possible to do what I want, yet every guide tells me to do exactly what I'm doing. And yet nginx is serving the wrong ...
1
vote
1answer
217 views

How do you quickly test to see if a user-agent supports Server Name Indication (SNI)?

There used to be a handy site http://sni.velox.ch that'd quickly tell you if your browser or a proxy along the way was preventing you sending an SNI header. I have an IoT device which I can cause to ...
2
votes
1answer
3k views

easy_install and pip fail with SSL warnings

I'm looking after some RHEL6 servers and trying to set them up to use an internal PyPi server (proxied by Nexus 3). The problem is that our internal PyPi server is one of several SSL VHosts on the ...
0
votes
1answer
1k views

Sni multiple ssl on different virtualhosts Apache 2.4.10 (Debian)

Is it possible to set up multiple domains ssl on that apache version? I have site A -> ssl certificate A site B -> certificate B then each file has a virtualhost like this, but it's not working: ...
1
vote
1answer
646 views

Apache SNI Issues with SSL Certificates

I'm having issues with my VirtualHost configurations on my server. My server is running Ubuntu 14.04.5 LTS (GNU/Linux 4.4.0-31-generic x86_64), with Apache/2.4.7 (Ubuntu). I've done a lot of reading ...
1
vote
0answers
443 views

squid transparent proxy proxying SSL connections without intercepting

Newer version of squid support proxying SSL connection based on HTTPS SNI. I used other tools which working as a same concept but they are not good. I need to use squid for this purpose and SSL slice ...
3
votes
1answer
4k views

How to check apache for SNI (Server Name Indication ) availability?

I have a centos 7 server. I switched from apache 2.4.6 to apache 2.4.25 using IUS repository (https://ius.io/). My goal is to support multiple SSL certificates with a single IP. I have installed: ...
0
votes
1answer
367 views

SNI for Multiple Hosts on Lighttpd

Inherited lighttpd server, I'm somewhat clueless on it. Trying to use SNI to install a 3rd SSL cert without another IP. Currently the SSL config in lighttpd.conf looks like so: $SERVER["socket"] == ":...
0
votes
1answer
553 views

TLS/SSL - Does SNI Have a Limit on Number of Domains Running on Nginx?

SNI (Server Name Indication) is an extension to the TLS/SSL protocol, allowing the webserver to serve multiple domains on the same IP, all with different SSL server certificates. SNI discovers the ...
0
votes
1answer
171 views

Can I configure IIS to listen to many, yet different cipher configurations of TLS?

I need to programmatically determine the TLS features of a client and underlying host based on Javascript. What webserver instance (apache, IIS, etc), allows for different configurations of SSL ...
0
votes
1answer
334 views

Redirect all nginx traffic to SSL except one single php

I have a prestashop site which is all in SSL. The problem I have is that the paymemnt gateway return is unable to do it with SSL, so I have to create an exception on my nginx config to accept the ...
0
votes
1answer
178 views

LetsEncrypt and other CA mixed in Apache2.2 “overlap”

seems like i can't get another SSL-Certificate on my maschine running. I work on an Apache 2.2 and we got a domain with an SSLCertificate, signed by GlobalSign. Now i wanted to add another ...
1
vote
2answers
1k views

Use virtual host certificate

I'm trying to enable SSL in name-based virtual hosts. From docs I understand that SNI does not need to be enabled explicitly, it happens automatically if both server and client comply with minimum ...
1
vote
0answers
276 views

Enabling TLS/SSL with SNI on a subset of websites, without losing SEO ranking on the non-TLS sites

We run a number of LAMP servers on AWS with a few dozen websites on them, that customers pay us to design, build and host. They're Ubuntu 14.04 servers with Varnish, Apache and PHP. Currently, if a ...
1
vote
1answer
286 views

how SNI works with google app engine?

i found that google app engine support multiple custom domain in single google app engine application. possibly it can be done using multi-tenancy domain/namespace. and i want to use ssl for those ...
1
vote
1answer
678 views

haproxy logging of req.ssl_sni

I am trying to extend a custom haproxy log-format by adding [req.ssl_sni]. The haproxy version used is 1.6.3 on Ubuntu. The frontend is configured in the following way: bind *:443 mode tcp tcp-...
0
votes
1answer
119 views

SNI Apache SSL Certificate

For SNI Apache setup: Is it okay to: use one security certificate for all virtual hosts with aliases to the urls and Is there a difference between: using one security certificate for all virtual ...
1
vote
0answers
335 views

Stunnel with SNI: Section *name*: SNI section name not found

Im trying to use stunnel with 2 domains on the same IP. My conf is this: ;key = /etc/ssl/private/namecheap/server.key # See this link http://www.sysadminworld.com/2011/how-do-i-use-an-intermediate-...
21
votes
4answers
16k views

What is the difference between SAN and SNI SSL certificates?

Could someone explain me the difference between these certificates in a simplified way? I read some articles but it sounds like they do the same job, namely encrypting many domains with one ...
0
votes
0answers
150 views

Why can I access my IIS websites from internal LAN, but not externally when going over HTTPS

I have an IIS8.5 which hosts about 10 Websites. I also have a EV-SSL certificate from GoDaddy and a "normal" SSL Certificate signed by GoDaddy which I use for my sites. To get this working I had to ...
4
votes
2answers
834 views

Enabling OCSP stapling on IIS SNI-enabled site

If Require Server Name Indication is checked on the binding of an IIS site, OCSP stapling is disabled for the site. This is easily confirmed by enabling SNI for a site that currently doesn't require ...
0
votes
0answers
365 views

Apache httpd2.4 - VirtualHost and _default_ Configuration Hierarchy

I have httpd 2.4 on RHEL7 and experimenting SNI integration before apply it to production environment. I experienced an interesting behavior. Server always serve the matched virtualhost content of www....
0
votes
1answer
323 views

Nginx SNI and Letsencrypt on FreeBSD; Wrong certificate?

I have a VPS with 14 domains and I setup letskencrypt to automatically retrieve a separate certificate for each domain with all sub-domains included. So, I have 14 certs. Obviously, putting all ...
9
votes
2answers
1k views

Can a hardware load-balancer route SSL traffic with SNI?

We've got a webserver farm currently hosting 2 applications - both applications are running on all servers. We want to split this so we have a dedicated server farm for each app (we have good reasons ...
6
votes
1answer
353 views

Apache Remote proxy for a reverse proxy SNI mismatch

Having an issue with our setup of an Apache-2.2 and a reverse proxy which is proxied to via another device. flow is: Apache A -> proxy.abc.net -> Apache B The error we get on Apache B is Hostname ...
1
vote
1answer
545 views

Fetch an SNI certificate from https with openssl [duplicate]

I know I can print out a site's certificate with OpenSSL like this: openssl s_client -showcerts -connect sni.velox.ch:443 But on some sites it doesn't work because they rely on SNI. Is there a way ...