Questions tagged [sni]

Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address

Filter by
Sorted by
Tagged with
0 votes
1 answer
72 views

How can I determine the valid SNIs accepted by an SSL/TLS certificate?

Something driving me nuts on this.. I am testing to an SSL certificate and using different SNIs to determine what is acceptable. I do not own/manage the cert, so am relying on s_client to give me the ...
jackbmg's user avatar
1 vote
0 answers
182 views

haproxy sni for http/3 quic (udp)

I've got haproxy doing sni routing for a bunch of sites without issue. HTTP/2 works great. Is there a way to setup sni type routing for HTTP/3 (quic) without having any certs installed in haproxy?
David's user avatar
  • 331
0 votes
0 answers
144 views

IIS resets TLS handshake with nginx reverse proxy

I am using 2 synchronized IIS servers (as backend for failover) and an nginx reverse proxy (as frontend). Both IIS servers have identical configuration and websites (due to sync). All websites are ...
cladmin's user avatar
0 votes
1 answer
420 views

Reverse TCP proxy ports 80 and 443 by server hostname [duplicate]

I have one public IP address. I am trying to allow access via the public IP on ports 80 and 443 to multiple services, differentiated by requested server name. HOWEVER, one service requires a TCP ...
Blair's user avatar
  • 1
0 votes
0 answers
205 views

SNI and TLS errors on apache reverse proxy host when proxying multiple sites from different servers?

I have an apache2 reverse proxy which is proxying many services including zabbix and nextcloud, and applying a wildcard SSL certificate to said services. These are individual virtual hosts, though ...
surfrock66's user avatar
0 votes
0 answers
288 views

Use custom SNI for Cloudflare

I have an app back-end on a server it has many users in China and it uses websocket, I'm doing some tests to bypass GFW's blockage of SNI, we can connect to Cloudflare Websocket websites in China, but ...
Steve Moretz's user avatar
0 votes
0 answers
108 views

Configuration of dummy default vhost and prevent virtual host fallback with https requests to IP-PD host

Background Consider 4 hypothetical FQDNs that all resolve to 192.0.2.42: example.com www.example.com foo.example.org legacy.example.net Now, consider two hypothetical servers bound to 192.0.2.42 (...
Bitbang3r's user avatar
  • 145
0 votes
1 answer
425 views

How to get a secure HTTP monitor in NetScaler to send SNI in its request?

We have a content switch in front of a virtual server in NetScaler ADC, and it acts as a load balancer. It is tied to a service group that has an HTTP monitor. We cannot get this monitor to work. The ...
Martin Ørding-Thomsen's user avatar
0 votes
1 answer
867 views

How to run nginx and ocserv on the same IP:Port using the same domain name?

How to run nginx and ocserv on the same IP:Port using the same domain name? Just like how a similar thing is possible by using SSTP protocol, if I am not mistaken. I am using Ubuntu 20.04.
Masood Lapeh's user avatar
1 vote
1 answer
1k views

How to use AD CS to auto-renew certs for securing IIS websites that use SNI?

I have AD CS which automatically provisions and renews machine certificates for servers bound to the directory. (There is a certificate template which controls this auto-issuance.) I have an IIS ...
NReilingh's user avatar
  • 484
1 vote
2 answers
840 views

Linux netfilter NAT based on SNI?

I am trying to do SNI proxying to a subnet on a router while keeping the src IP. Background: I have a router doing DNAT to do port-forwarding for many application ports, and it is connected to a ...
Yuuta Liang's user avatar
1 vote
1 answer
552 views

SSL alternative names mismatch

Santander want to use our website, however when trying to access it they receive the following error: 'Network Error: Your request contacted a host which presented a certificate signed by an untrusted ...
Andy's user avatar
  • 11
1 vote
1 answer
311 views

Getting AH02032 using TLSv1.2 despite identical SNI server name and Hostname, but SNI has the port number attached. No error in test env. with TLSv1.3

Getting the the error message below despite identical Hostnames. What I don't understand, why the Hostname provided via SNI has the port number attached even though, according to Hostname ...
daniel buettiker's user avatar
1 vote
0 answers
959 views

Envoy to envoy TLS for TLS proxy

Assume this artitecture ................................................ . . ...
M.A. Heshmat Khah's user avatar
3 votes
1 answer
2k views

Why is "tcp-request content accept" frontend instruction is required for proper HAProxy SNI-based routing?

I've recently tried to set up SNI-based routing on HAProxy for mongodb mongodb+srv protocol connection. I made it working, but it wasn't until I put tcp-request inspect-delay 5s tcp-request content ...
Pavel Klimov's user avatar
0 votes
1 answer
619 views

IIS 10 2 domains with SSLs on same IP - SNI checked for both but 1 of them still doesnt work

Using fictional domains here instead of the actual ones I have this situation: domain1.com has binding set up in IIS and is linked to SSL and has "Require Server Name Indication" checked. ...
Paul's user avatar
  • 113
0 votes
2 answers
966 views

SSL Certificate not valid on SNI server - Dovecot/Postfix

I've got a Dovecot/Postfix server running on a Raspberry Pi running Raspbian 10 (Buster) I have two domain names running on the same server which for privacy I'll call DOMAIN 1 and DOMAIN 2. Both have ...
The All Powerful's user avatar
1 vote
1 answer
283 views

Can there be a "TLS Passthrough based on SNI" version of CloudFlare's "orange-cloud"?

My understanding is that the "orange-cloud" [1] is a TLS terminating reverse proxy. Multiple upstream servers share the same Cloudflare Anycast IP. A TLS connection is formed between the ...
Starfish's user avatar
1 vote
1 answer
2k views

How does a TLS Passthrough reverse proxy based on SNI work?

There are various articles and questions explaining how to use a given reverse proxy's (e.g. nginx) implementation of this [1] [2] [3] [4], but none explain how this actually works under the hood. By &...
Starfish's user avatar
1 vote
1 answer
2k views

HAProxy is not working with SNI and ACLs

I am trying to get haproxy to use acls with SNI and it ain't cooperating. It presents the correct cert so SNI must be working. However, I cannot get it to select a backend based on the hostname in ...
scarville's user avatar
0 votes
1 answer
3k views

HAPROXY SNI SSL pass through or termination

I would like to set up HAProxy to terminate SSL or pass through connection depends from hostname, exposing only one public IP address. For example Internet -> domain web1.example.com (10.10.10.1) ...
pa bloo's user avatar
0 votes
0 answers
3k views

SNI header missing from TLS Client Hello when using HTTP proxy

I'm debugging a problem with a Java-based application that retrieves a JSON payload (the CVE list from NIST) over HTTPS. When I connect directly to NIST, I retrieve the data successfully. When I use ...
Gordon Mckeown's user avatar
1 vote
0 answers
670 views

IIS serves wrong cert using SNI or CCS

I have 3 websites all using the same IP in IIS 10. I first setup the https bindings to use SNI with 'all assigned' IP addresses on port 443 using the correct certificate. All the certs are known good. ...
dcol's user avatar
  • 73
0 votes
1 answer
2k views

How to force a specific routing based on SNI in HAProxy?

I have the following HAProxy configuration: listen sni-443 bind *:443 mode tcp timeout connect 4s timeout client 3m timeout server 3m tcp-request inspect-delay 5s tcp-...
Torsten Bronger's user avatar
-1 votes
1 answer
159 views

What is SNI (with specific reference to Plivo)

Plivo have announced that they are depreciating their Legacy Messaging API for SNI. I've been unable to find any documentation on the topic (ideally with code samples) on their portal. I'm not been ...
chribonn's user avatar
  • 141
0 votes
0 answers
282 views

Disable SNI on Apache

I've a Windows Server 2016 installed with Apache 2.4.37 In the Apache server, I've setup multiple virtual host like: abc.host.com def.host.com ghi.host.com All this virtual host share the same IP ...
ruby.lee's user avatar
0 votes
1 answer
2k views

select an haproxy tcp back end depending on source ip

I have basic haproxy knowledge and know how to handle the selection of tcp backends depending on the SNI server name. The relevant lines are acl is_myhost req.ssl_sni -i my.host.com acl ...
gelonida's user avatar
  • 279
1 vote
0 answers
88 views

AWS Elastic Beanstalk SNI SSL in S3

In our application we need to support customer ssl certificates and domains. Application stack: AWS Elastic Beanstalk, NodeJs and nginx server. I've found that we can use nginx variable "$...
Evgeny I's user avatar
1 vote
2 answers
9k views

Nginx: How to combine ssl_preread_protocol with ssl_preread_server_name (ssh-multiplexing and ssl-sni-passthrough)?

I have the nginx.conf file shown below. I want to run both ssh and a webserver on port 443/SSL. Also known as SSL-port-multiplexing. At the same time, I want to use ssl-passthrough with SNI. For ssh-...
Quandary's user avatar
  • 1,024
3 votes
1 answer
7k views

Nginx and https - Specifying an ip address as a server_name gives the correct website but the wrong certificate

I want to run this url: https://192.168.1.254 and get a website with the correct content and certificate in the address bar. I am getting the website but I get an invalid certificate error in the ...
FlexMcMurphy's user avatar
0 votes
1 answer
480 views

nginx behind haproxy - pages randomly loading regardles of submited domain

I currently have one web server (10.0.0.77) running nginx with multipple vhosts (couple of wordpress sites and nextcloud installation) all running on 1 IP address and everything is secured with a ...
Paul's user avatar
  • 169
2 votes
1 answer
4k views

HAProxy: SSL Termination with exception for a specific domain Wildcard SSL-Certificate request

I am new to HAProxy and got most parts working as expected. The current setup is: If I add a new site to one of the balanced (behind the LB) servers, the certificate is issued and served by the Load ...
Philipp's user avatar
  • 23
2 votes
1 answer
1k views

ldapsearch fails on centos8 with Google LDAPS but works on Ubuntu 20.04 with work around

My end goal is to use sssd and Google LDAPS but can tell if things will work with ldapsearch. Google LDAPS requires the Server Name Indication (SNI) extension. I have it working on Ubuntu 20.04 with a ...
Guser314's user avatar
  • 211
0 votes
1 answer
886 views

Postfix SSL USING SNI

I What to give assign multiple SSL cert to Multiple Domains I have manage to do so : by creating a single wild card SSL cert (e.g mail.example.com , mail.example2.com, etc) But I Want Each domain to ...
Bc96's user avatar
  • 3
0 votes
1 answer
287 views

SNI in pure-ftpd

I'm looking for SNI support in pure-ftpd. I found some documentation here: https://download.pureftpd.org/pub/pure-ftpd/doc/README.TLS Please read section CUSTOM CERTIFICATE HANDLERS in the above link. ...
Dirty_Programmer's user avatar
2 votes
1 answer
2k views

Nginx upstream keepalive with SNI

I've got Nginx setup to proxy two subdomains. SNI is used so each subdomain has a different SSL certificate. Nginx setup is roughly: upstream a_example_443 { server 1.2.3.4:443; keepalive 128; ...
Nate's user avatar
  • 204
3 votes
1 answer
12k views

AWS ALB/NLB HTTPS Target with Self-Signed Cert

I am using AWS to build a service. For this service I want to use ACM certificates. The backend is running on an EC2 instance with TLS enabled using a self-signed certificate. Since ACM certificates ...
TenPlusFive's user avatar
1 vote
0 answers
923 views

SNI fails on nginx - wrong cert being issued

I've been testing my various websites security at Qualsys. All my sites run off of one nginx host. The sites work fine and get an A+ on the Qualsys tests. The only issue that I really want to fix is ...
Callahan's user avatar
1 vote
0 answers
187 views

Logging source IP for connection through SNI proxy

I'm using a simple SNI proxy (slt) to forward HTTPS to the correct virtual machine without terminating SSL in the proxy. Something that is glaringly obvious in hindsight: there is no way for me to ...
Simon Richter's user avatar
1 vote
1 answer
319 views

https with sni two certs tho server names but same config. can I use one server block?

I often encounter following problem. I have an nginx server serving two hostnames via https on the same IP and the same port. Each host name has it's own cert. What I am doing so far is to have two ...
gelonida's user avatar
  • 279
1 vote
1 answer
3k views

Nginx selective TLS passthrough reverse proxy based on SNI

I have system of IoT devices behind a NAT, so they are not accessible from the public internet (although it's desired). To overcome this I tied them into a VPN, with one member exposed to the public ...
Ákos Vandra-Meyer's user avatar
5 votes
1 answer
16k views

How to get HAProxy to route TCP based on SNI (using openssl s_client to test)?

I want to use HAProxy to terminate TLS-encrypted TCP connnections and to pass the unencrypted TCP traffic to various backends based on the Server Name Indication used to initiate the TLS connection. ...
John's user avatar
  • 293
2 votes
1 answer
157 views

Run 2 SSL servers on 1 debian Pi, both FQDNs,1 Nginx 1 apache, wrong certificate, is this SNI issue?

I'm forced to use Nginx on a.ddns.net and Apache for b.ddns.net (reverse proxy solution too tricky due to established setups). Real server names edited but both verified as resolving to same IP and ...
awsbarker's user avatar
0 votes
1 answer
184 views

Redirect http and non-www using only mod_alias Redirect, dedup SSL configuration?

This is probably a duplicate but I can't find quite what I'm looking for. I'd like to redirect http and/or non-www to https+www. This is often cited as a canonical example of when to avoid mod_rewrite....
Rob's user avatar
  • 1
1 vote
0 answers
101 views

Why is my SSL Cert/IIS Setup not working correctly?

I have 2 domains that are pointed to the same website in IIS 8.5 on Windows Server 2012, domaina.com and domainb.com. Domaina.com is the primary website and domainb.com is the secondary site. Right ...
Reaction21's user avatar
0 votes
2 answers
3k views

Generic SNI-based transparent TLS proxy without having to enumerate all backends?

I'm in a situation where I have to provide a transparent reverse proxy in front of a set of thousands of backend https webservers, with the list changing (relatively) frequently. I know I can tell ...
András Korn's user avatar
1 vote
0 answers
2k views

F5 SNI Passthrough

G'day all, I'm trying to configure an F5 virtual Big-IP for L4 pass through SNI load balancing, but am having troubles (probably because I'm new to F5's). We have backend websites that require SNI (...
Wokket's user avatar
  • 11
8 votes
1 answer
2k views

SNI for a SMTP server

Let's say I have a dedicated server with some IP (IP1). I'm redirecting multiple domains (say example.com, example.net) to that IP via DNS. I've a single nginx server running here, and I've set up SNI ...
xryl669's user avatar
  • 238
1 vote
0 answers
633 views

Is it possible to mix SSI and non-SSI bindings, same IP address and port, in IIS 8.5

I found a good resources over at a Microsoft blog which goes into detail about IIS, SNI, and even some CCS: https://blogs.msdn.microsoft.com/kaushal/2012/09/04/server-name-indication-sni-with-iis-8-...
user3621633's user avatar
0 votes
1 answer
143 views

Apache SNI: Is it possible to mix non-secure hosts with secure hosts on the same interface?

On a shared server, we have some sites that only run on port 80. However, there are other sites that run on both port 80 and 443. For example: <VirtualHost *:80> ServerName unsecure.com </...
Nick's user avatar
  • 103