Questions tagged [sni]
Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address
28
questions
110
votes
5
answers
79k
views
Multiple SSL domains on the same IP address and same port?
This is a Canonical Question about Hosting multiple SSL websites on the same IP.
I was under the impression that each SSL Certificate required it's own unique IP Address/Port combination. But the ...
26
votes
4
answers
29k
views
Can a Reverse Proxy use SNI with SSL pass through?
I need to serve several applications over https using one external ip address.
The ssl certificates should not be managed on the reverse proxy. They are installed on the application servers.
Can a ...
2
votes
2
answers
1k
views
Stop default SSL response on Shared IP using SNI
Previously I asked a question here: Single domain SSL presented for all domains on Shared IP about setting up secure and non-secure domains on a single IP.
Opinions were mixed, but it appears SNI ...
1
vote
1
answer
374
views
Understand ssl setup
Goals:
If the user support SNI and hit myurl1.server.com (https) or myurl2.server.com (https) it will match the right vhost. (the last 2 vhosts)
If the user does not support SNI and hit myurl1.server....
21
votes
6
answers
17k
views
Redirect to SSL only if browser supports SNI
I have Apache 2.2 with mod_ssl and a bunch of sites in HTTPS on the same IP/port with VirtualHosting, so client must support SNI to connect to those virtual hosts.
I would like to configure my server ...
7
votes
2
answers
4k
views
How to stop HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (Apache-SNI)
I hope that title is clear.
How do I prevent HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (setup is Apache-SNI).
For example, using my abbreviated ...
5
votes
2
answers
12k
views
Disabling SNI for specific virtualhost on Apache
We have a web server with a couple of internet IPs.
I have successfully set up SNI name based virtualhosts, it's working great. What I'd like to do though is have our main site NOT use SNI and use ...
4
votes
1
answer
2k
views
For enabling SSL for a single domain on a server with muliple vhosts, will this configuration work?
I just purchased an SSL certificate to secure/enable only ONE domain on a server with multiple vhosts. I plan on configuring as shown below (non SNI). In addition, I still want to access phpMyAdmin, ...
32
votes
4
answers
35k
views
What is the difference between SAN and SNI SSL certificates?
Could someone explain me the difference between these certificates in a simplified way? I read some articles but it sounds like they do the same job, namely encrypting many domains with one ...
10
votes
2
answers
9k
views
using nginx with SNI
By now I've not used SNI with nginx yet. But as IP address pools are quite filled and commercial XP support is about to cease (finally) I'm thinking about converting a few sites to SNI.
I'm aware of ...
2
votes
1
answer
3k
views
Can NGINX inspect the TLS request to look for SNI like HAProxy (etc) does?
It seems that, when configuring HAProxy for hostname routing on HTTPS connections, it is crucial to include a tcp-request inspect-delay directive to "give HAProxy a chance to look into the connection"....
21
votes
3
answers
38k
views
"Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile]" error
After recently upgrading Apache2 to version 2.2.31 I found a strange behaviour in SSL VirtualHost setup.
A few of the website I'm hosting were showing the certificate for the default host even if the ...
12
votes
3
answers
16k
views
SNI and wildcard SSL certificates on the same server with IIS
I'd like to host a website that should listen to subdomains (e.g. sub.domain.com) together with multiple websites that live just under a second-level domain (e.g. domain2.com, domain3.com) with IIS ...
10
votes
2
answers
65k
views
Why does apache httpd tell me that my name-based virtualhosts only works with SNI enabled browers (RFC 4366)
Why does apache give me this error message in my logs? Is it a false positive?
[warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
I ...
8
votes
3
answers
984
views
Upgrade HTTP connection to SSL/TLS
I currently have a server which automatically redirects all HTTP requests to the equivalent HTTPS site.
The problem is that is seems like some browsers do not accept the SSL certificate (StartSSL.com) ...
7
votes
2
answers
9k
views
Enabling OCSP stapling on IIS SNI-enabled site
If Require Server Name Indication is checked on the binding of an IIS site, OCSP stapling is disabled for the site.
This is easily confirmed by enabling SNI for a site that currently doesn't require ...
7
votes
4
answers
22k
views
Apache SNI namevhosts always route to first VirtualHost entry
Apache seems to route all https requests to the first <VirtualHost *:443> regardless of SNI matching on ServerName/ServerAlias fields.
Apache is built with SNI
Server version: Apache/2.2.22 (...
6
votes
1
answer
13k
views
HTTP status code to signal bad or missing Host header
Is there an HTTP status code which is appropriate to use for clients which send a bad hostname (or none at all) through SNI or the HTTP Host header?
An older question address how and why such ...
6
votes
3
answers
13k
views
Jenkins reports reverse proxy setup incorrect with Apache using virtual hosts with SNI
I'm setting up a Jenkins server, to run under Tomcat behind Apache. I'm using virtual hosts with SSL using SNI so I can access it at https://jenkins.example.com, and serve something else on, say, http:...
4
votes
4
answers
13k
views
Upgrading OpenSSL in CentOS 5.3
I want to use one IP to host many domains with individual SSL certificates (requires SNI). In CentOS 5.3, the latest version of OpenSSL I can find an RPM for is 0.9.8e, which does not support SNI.
I ...
4
votes
1
answer
7k
views
How to check haproxy sni-based rule with curl?
I made simple HaProxy configuration to pass thorough traffic based on SNI field. Here is my haproxy.cfg
defaults
log global
timeout client 50s
timeout client-fin 50s
timeout connect ...
3
votes
1
answer
9k
views
Does NGINX support SNI or does it not?
EDIT New question: Can NGINX inspect the TLS request to look for SNI like HAProxy (etc) does?
According to what I've read around (and I've been told), NGINX should not support SNI and I should go for ...
3
votes
1
answer
2k
views
Why is "tcp-request content accept" frontend instruction is required for proper HAProxy SNI-based routing?
I've recently tried to set up SNI-based routing on HAProxy for mongodb mongodb+srv protocol connection.
I made it working, but it wasn't until I put
tcp-request inspect-delay 5s
tcp-request content ...
2
votes
2
answers
1k
views
Windows Vista Wrong Certificate With SNI
I'm setting up SNI on an apache server and I thought things were going well. I have two URLs from different domains that point at the same site. I have one virtual host setup for each with the ...
2
votes
2
answers
3k
views
Command line to set up SNI on IIS for Windows 2012
I'm trying to complete the automated build script of my web server, which runs Windows 2012 and has two SSL websites, each with its own digital certificate.
I am using SNI, which works fine when I ...
1
vote
1
answer
2k
views
nginx and SNI: is it possible to automatically resolve SSL certificate by domain name
I need to setup a server that will server same content over SSL using different domain names.
The problem is that I need an ability to add new domain names as easily as possible.
Assuming that all ...
0
votes
1
answer
498
views
is a wildcard SSL the only option in this multiple VHOST/1IP setup?
I have a web app set up that needs the following SSL encryption:
secure.myapp.com -> SSL
www.myapp.com/login -> SSL
www.myapp.com/signup -> SSL
If I'm correct, I could run one SSL ...
0
votes
3
answers
4k
views
Strict SNI matching for Apache
I have multiple SSL vhosts and non-SSL vhosts served from a single server. If one of the non-ssl vhosts is accessed using "https", the first SSL directive is used. Is there some setting to make it so ...