Questions tagged [sni]

Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address

Filter by
Sorted by
Tagged with
0
votes
0answers
22 views

(NGINX) How do I reject ssl request by SNI

Using SNI, I need to abort the connection when there is no upstream backend server configured for that domain I have my proxy server configured like this stream { map $ssl_preread_server_name $name ...
0
votes
0answers
18 views

Multiple sites with different certificates and different DNS with same IP address on IIS : Error

I have two DNS mappings for single IP address (DNS1: site1.net, DNS2: site2.net) and also I have created two different certificates for two sites as (Cert1: site1.net, Cert2: site2.net). When I create ...
0
votes
0answers
455 views

Nginx: How to combine ssl_preread_protocol with ssl_preread_server_name (ssh-multiplexing and ssl-sni-passthrough)?

I have the nginx.conf file shown below. I want to run both ssh and a webserver on port 443/SSL. Also known as SSL-port-multiplexing. At the same time, I want to use ssl-passthrough with SNI. For ssh-...
1
vote
1answer
210 views

Nginx and https - Specifying an ip address as a server_name gives the correct website but the wrong certificate

I want to run this url: https://192.168.1.254 and get a website with the correct content and certificate in the address bar. I am getting the website but I get an invalid certificate error in the ...
0
votes
0answers
28 views

nginx behind haproxy - pages randomly loading regardles of submited domain

I currently have one web server (10.0.0.77) running nginx with multipple vhosts (couple of wordpress sites and nextcloud installation) all running on 1 IP address and everything is secured with a ...
1
vote
1answer
737 views

HAProxy: SSL Termination with exception for a specific domain Wildcard SSL-Certificate request

I am new to HAProxy and got most parts working as expected. The current setup is: If I add a new site to one of the balanced (behind the LB) servers, the certificate is issued and served by the Load ...
0
votes
1answer
189 views

ldapsearch fails on centos8 with Google LDAPS but works on Ubuntu 20.04 with work around

My end goal is to use sssd and Google LDAPS but can tell if things will work with ldapsearch. Google LDAPS requires the Server Name Indication (SNI) extension. I have it working on Ubuntu 20.04 with a ...
0
votes
1answer
241 views

Postfix SSL USING SNI

I What to give assign multiple SSL cert to Multiple Domains I have manage to do so : by creating a single wild card SSL cert (e.g mail.example.com , mail.example2.com, etc) But I Want Each domain to ...
0
votes
1answer
76 views

SNI in pure-ftpd

I'm looking for SNI support in pure-ftpd. I found some documentation here: https://download.pureftpd.org/pub/pure-ftpd/doc/README.TLS Please read section CUSTOM CERTIFICATE HANDLERS in the above link. ...
1
vote
1answer
300 views

Nginx upstream keepalive with SNI

I've got Nginx setup to proxy two subdomains. SNI is used so each subdomain has a different SSL certificate. Nginx setup is roughly: upstream a_example_443 { server 1.2.3.4:443; keepalive 128; ...
0
votes
1answer
2k views

AWS ALB/NLB HTTPS Target with Self-Signed Cert

I am using AWS to build a service. For this service I want to use ACM certificates. The backend is running on an EC2 instance with TLS enabled using a self-signed certificate. Since ACM certificates ...
1
vote
0answers
169 views

SNI fails on nginx - wrong cert being issued

I've been testing my various websites security at Qualsys. All my sites run off of one nginx host. The sites work fine and get an A+ on the Qualsys tests. The only issue that I really want to fix is ...
1
vote
0answers
23 views

Logging source IP for connection through SNI proxy

I'm using a simple SNI proxy (slt) to forward HTTPS to the correct virtual machine without terminating SSL in the proxy. Something that is glaringly obvious in hindsight: there is no way for me to ...
1
vote
1answer
127 views

https with sni two certs tho server names but same config. can I use one server block?

I often encounter following problem. I have an nginx server serving two hostnames via https on the same IP and the same port. Each host name has it's own cert. What I am doing so far is to have two ...
1
vote
1answer
836 views

Nginx selective TLS passthrough reverse proxy based on SNI

I have system of IoT devices behind a NAT, so they are not accessible from the public internet (although it's desired). To overcome this I tied them into a VPN, with one member exposed to the public ...
2
votes
1answer
3k views

How to get HAProxy to route TCP based on SNI (using openssl s_client to test)?

I want to use HAProxy to terminate TLS-encrypted TCP connnections and to pass the unencrypted TCP traffic to various backends based on the Server Name Indication used to initiate the TLS connection. ...
2
votes
1answer
63 views

Run 2 SSL servers on 1 debian Pi, both FQDNs,1 Nginx 1 apache, wrong certificate, is this SNI issue?

I'm forced to use Nginx on a.ddns.net and Apache for b.ddns.net (reverse proxy solution too tricky due to established setups). Real server names edited but both verified as resolving to same IP and ...
0
votes
1answer
85 views

Redirect http and non-www using only mod_alias Redirect, dedup SSL configuration?

This is probably a duplicate but I can't find quite what I'm looking for. I'd like to redirect http and/or non-www to https+www. This is often cited as a canonical example of when to avoid mod_rewrite....
1
vote
0answers
71 views

Why is my SSL Cert/IIS Setup not working correctly?

I have 2 domains that are pointed to the same website in IIS 8.5 on Windows Server 2012, domaina.com and domainb.com. Domaina.com is the primary website and domainb.com is the secondary site. Right ...
0
votes
2answers
1k views

Generic SNI-based transparent TLS proxy without having to enumerate all backends?

I'm in a situation where I have to provide a transparent reverse proxy in front of a set of thousands of backend https webservers, with the list changing (relatively) frequently. I know I can tell ...
1
vote
0answers
790 views

F5 SNI Passthrough

G'day all, I'm trying to configure an F5 virtual Big-IP for L4 pass through SNI load balancing, but am having troubles (probably because I'm new to F5's). We have backend websites that require SNI (...
4
votes
1answer
852 views

SNI for a SMTP server

Let's say I have a dedicated server with some IP (IP1). I'm redirecting multiple domains (say example.com, example.net) to that IP via DNS. I've a single nginx server running here, and I've set up SNI ...
0
votes
0answers
283 views

Is it possible to mix SSI and non-SSI bindings, same IP address and port, in IIS 8.5

I found a good resources over at a Microsoft blog which goes into detail about IIS, SNI, and even some CCS: https://blogs.msdn.microsoft.com/kaushal/2012/09/04/server-name-indication-sni-with-iis-8-...
0
votes
1answer
35 views

Apache SNI: Is it possible to mix non-secure hosts with secure hosts on the same interface?

On a shared server, we have some sites that only run on port 80. However, there are other sites that run on both port 80 and 443. For example: <VirtualHost *:80> ServerName unsecure.com </...
1
vote
2answers
2k views

How does HAProxy choose which certificate to serve?

I've got a HAProxy 1.5.9 server that will serve either a certificate signed by a self signed CA or a Let's Encrypt certificate depending on which 'servername' is provided. This is my configuration ...
0
votes
1answer
74 views

What will happen if client call Apache server by IP and there are two SNI virtual hosts [duplicate]

We have a Apache 2.4 web server with a couple of virtual hosts with different certificates. I have set up SNI name based virtualhosts : ap.mmm.com and ac.mmm.com, it's working great. All on same IP (...
0
votes
1answer
1k views

How to split vpn traffic from https traffic on the same port using haproxy?

I have a following goal: Running softhether vpn and web applications both on port 443. I want all traffic to come to haproxy, which sends vpn to one container, and the rest to another container (...
0
votes
1answer
2k views

HAProxy does not perform SNI lookup

HAProxy v.1.5.18, 1.7.11, listening on a single IP address with a wildcard SSL certificate, I need to specify several backends with SNI lookup. There's a ton of config-files that all say req_ssl_sni -...
1
vote
1answer
651 views

How does nginx handle $proxy_host as SNI

Setup: I have an nginx client which is sending a HTTPS request to an nginx origin server. I have been doing my research on how the directive 'proxy_ssl_name' can be used to overwrite the SNI. ...
1
vote
1answer
319 views

HAProxy dynamic server address based off of variable

I want to dynamically route to a server by making use of a request variable ssl_fc_sni. Is it possible to configure haproxy server statement to use a variable for address and/or port? Example backend ...
2
votes
1answer
1k views

Ideal Setup of Apache for multiple SSL certs with SNI on a single IP

I'm looking for the most efficient way to achieve this setup on Apache 2.4.33 in the Amazon Linux Distro: a single server instance (here: AWS EC2) a single associated IP two (or more) domains, each ...
0
votes
1answer
1k views

Apache SNI config to send handshake alert: unrecognized_name

I am trying to achieve what some years ago was a problem due to miss configured servers that caused "handshake alert: unrecognized_name" when a SNI enabled client ( for Java 1.7 or bigger ...
1
vote
1answer
817 views

Apache 2.4 drop connection on default SSL host

I am running Apache 2.4 on Debian serving some SSL websites. My domain name und certificates contain my real name, so I don't want any random user typing in my IP address to get the certificate und my ...
0
votes
0answers
146 views

Support virtualhost routing without SNI support in the client

We are trying to build a TCP proxy that can forward to multiple virtual hosts. The idea is that a single IP address can be used to route inbound requests to multiple internal IP addresses. The initial ...
-1
votes
2answers
72 views

How To Ristrict SSL for one domain in VHOST Apache2 [duplicate]

I have configured Vhost on apache2.it is a name based configuration. First domain is ssl-secure and second one is non ssl-secure site.All are working fine if hit in browser address bar https://www....
5
votes
1answer
660 views

Is it possible to disable clients not supporting SNI in nginx?

By default nginx serves https requests with multiple certificates by using SNI. The fallback for clients not supporting SNI will be the default_server or first vhost which has been configured. I want ...
6
votes
2answers
12k views

No need to enable SNI for multiple SSL sites on same IP but using same wild card certificate?

I have an IIS server hosting: example.com/www.example.com sub1.example.com sub2.example.com They are listed as 3 separate sites under IIS, all bind to the same IP over HTTPS on 443. But they all use ...
1
vote
1answer
1k views

Nginx responds with 200 even when HTTP HOST header is different from SNI

I have just started learning about nginx and SSL and haven beentrying around different configurations. I have two server blocks like the following: server{ listen 443 ssl http2; server_name ...
0
votes
2answers
178 views

Apache Canonical Host with one SSL certificate for with www. and without

Using SNI, there are multiple domains with their own SSL certificates (LetsEncrypt) on one IP address. For one of the primary domains, let's just say https://thedomain.tld, visiting https://www....
3
votes
1answer
1k views

Cloudfront alternate domains using SNI for HTTPS

I am attempting to use Cloudfront to serve an S3 bucket over HTTPS using an "Alternate Domain Name", but I am getting this error when I load the site in a browser: NET::ERR_CERT_COMMON_NAME_INVALID ...
6
votes
1answer
6k views

HTTP status code to signal bad or missing Host header

Is there an HTTP status code which is appropriate to use for clients which send a bad hostname (or none at all) through SNI or the HTTP Host header? An older question address how and why such ...
4
votes
1answer
3k views

How to check haproxy sni-based rule with curl?

I made simple HaProxy configuration to pass thorough traffic based on SNI field. Here is my haproxy.cfg defaults log global timeout client 50s timeout client-fin 50s timeout connect ...
0
votes
3answers
2k views

Dockerized Nginx + Certbot + tls-sni challenge not working on renewal

I have an existing service running using docker containers: nginx (nginx:1.13.5) node-api (node container) node-website (node container) I wanted to add SSL certificates for both api and website. So ...
8
votes
2answers
2k views

How do I setup multiple subdomains with their own certificate using nginx?

Unless every answer that I've read was plain wrong, SNI should make it possible to do what I want, yet every guide tells me to do exactly what I'm doing. And yet nginx is serving the wrong ...
1
vote
1answer
468 views

How do you quickly test to see if a user-agent supports Server Name Indication (SNI)?

There used to be a handy site http://sni.velox.ch that'd quickly tell you if your browser or a proxy along the way was preventing you sending an SNI header. I have an IoT device which I can cause to ...
2
votes
1answer
14k views

easy_install and pip fail with SSL warnings

I'm looking after some RHEL6 servers and trying to set them up to use an internal PyPi server (proxied by Nexus 3). The problem is that our internal PyPi server is one of several SSL VHosts on the ...
0
votes
1answer
3k views

Sni multiple ssl on different virtualhosts Apache 2.4.10 (Debian)

Is it possible to set up multiple domains ssl on that apache version? I have site A -> ssl certificate A site B -> certificate B then each file has a virtualhost like this, but it's not working: ...
1
vote
1answer
1k views

Apache SNI Issues with SSL Certificates

I'm having issues with my VirtualHost configurations on my server. My server is running Ubuntu 14.04.5 LTS (GNU/Linux 4.4.0-31-generic x86_64), with Apache/2.4.7 (Ubuntu). I've done a lot of reading ...
4
votes
1answer
8k views

How to check apache for SNI (Server Name Indication ) availability?

I have a centos 7 server. I switched from apache 2.4.6 to apache 2.4.25 using IUS repository (https://ius.io/). My goal is to support multiple SSL certificates with a single IP. I have installed: ...
1
vote
1answer
839 views

SNI for Multiple Hosts on Lighttpd

Inherited lighttpd server, I'm somewhat clueless on it. Trying to use SNI to install a 3rd SSL cert without another IP. Currently the SSL config in lighttpd.conf looks like so: $SERVER["socket"] == ":...