Questions tagged [sni]

Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address

Filter by
Sorted by
Tagged with
110 votes
5 answers
79k views

Multiple SSL domains on the same IP address and same port?

This is a Canonical Question about Hosting multiple SSL websites on the same IP. I was under the impression that each SSL Certificate required it's own unique IP Address/Port combination. But the ...
learningtech's user avatar
  • 7,445
26 votes
4 answers
29k views

Can a Reverse Proxy use SNI with SSL pass through?

I need to serve several applications over https using one external ip address. The ssl certificates should not be managed on the reverse proxy. They are installed on the application servers. Can a ...
user319862's user avatar
2 votes
2 answers
1k views

Stop default SSL response on Shared IP using SNI

Previously I asked a question here: Single domain SSL presented for all domains on Shared IP about setting up secure and non-secure domains on a single IP. Opinions were mixed, but it appears SNI ...
esryl's user avatar
  • 135
1 vote
1 answer
374 views

Understand ssl setup

Goals: If the user support SNI and hit myurl1.server.com (https) or myurl2.server.com (https) it will match the right vhost. (the last 2 vhosts) If the user does not support SNI and hit myurl1.server....
chitech's user avatar
  • 13
21 votes
6 answers
17k views

Redirect to SSL only if browser supports SNI

I have Apache 2.2 with mod_ssl and a bunch of sites in HTTPS on the same IP/port with VirtualHosting, so client must support SNI to connect to those virtual hosts. I would like to configure my server ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
7 votes
2 answers
4k views

How to stop HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (Apache-SNI)

I hope that title is clear. How do I prevent HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (setup is Apache-SNI). For example, using my abbreviated ...
Jeff's user avatar
  • 1,426
5 votes
2 answers
12k views

Disabling SNI for specific virtualhost on Apache

We have a web server with a couple of internet IPs. I have successfully set up SNI name based virtualhosts, it's working great. What I'd like to do though is have our main site NOT use SNI and use ...
John Hunt's user avatar
  • 429
4 votes
1 answer
2k views

For enabling SSL for a single domain on a server with muliple vhosts, will this configuration work?

I just purchased an SSL certificate to secure/enable only ONE domain on a server with multiple vhosts. I plan on configuring as shown below (non SNI). In addition, I still want to access phpMyAdmin, ...
user1322092's user avatar
32 votes
4 answers
35k views

What is the difference between SAN and SNI SSL certificates?

Could someone explain me the difference between these certificates in a simplified way? I read some articles but it sounds like they do the same job, namely encrypting many domains with one ...
AFA Med's user avatar
  • 617
10 votes
2 answers
9k views

using nginx with SNI

By now I've not used SNI with nginx yet. But as IP address pools are quite filled and commercial XP support is about to cease (finally) I'm thinking about converting a few sites to SNI. I'm aware of ...
justlovingIT's user avatar
2 votes
1 answer
3k views

Can NGINX inspect the TLS request to look for SNI like HAProxy (etc) does?

It seems that, when configuring HAProxy for hostname routing on HTTPS connections, it is crucial to include a tcp-request inspect-delay directive to "give HAProxy a chance to look into the connection"....
Morpheu5's user avatar
  • 269
21 votes
3 answers
38k views

"Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile]" error

After recently upgrading Apache2 to version 2.2.31 I found a strange behaviour in SSL VirtualHost setup. A few of the website I'm hosting were showing the certificate for the default host even if the ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
12 votes
3 answers
16k views

SNI and wildcard SSL certificates on the same server with IIS

I'd like to host a website that should listen to subdomains (e.g. sub.domain.com) together with multiple websites that live just under a second-level domain (e.g. domain2.com, domain3.com) with IIS ...
Piedone's user avatar
  • 395
10 votes
2 answers
65k views

Why does apache httpd tell me that my name-based virtualhosts only works with SNI enabled browers (RFC 4366)

Why does apache give me this error message in my logs? Is it a false positive? [warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366) I ...
Arlukin's user avatar
  • 1,233
8 votes
3 answers
984 views

Upgrade HTTP connection to SSL/TLS

I currently have a server which automatically redirects all HTTP requests to the equivalent HTTPS site. The problem is that is seems like some browsers do not accept the SSL certificate (StartSSL.com) ...
foxylion's user avatar
  • 193
7 votes
2 answers
9k views

Enabling OCSP stapling on IIS SNI-enabled site

If Require Server Name Indication is checked on the binding of an IIS site, OCSP stapling is disabled for the site. This is easily confirmed by enabling SNI for a site that currently doesn't require ...
franzo's user avatar
  • 223
7 votes
4 answers
22k views

Apache SNI namevhosts always route to first VirtualHost entry

Apache seems to route all https requests to the first <VirtualHost *:443> regardless of SNI matching on ServerName/ServerAlias fields. Apache is built with SNI Server version: Apache/2.2.22 (...
arcyqwerty's user avatar
6 votes
1 answer
13k views

HTTP status code to signal bad or missing Host header

Is there an HTTP status code which is appropriate to use for clients which send a bad hostname (or none at all) through SNI or the HTTP Host header? An older question address how and why such ...
kasperd's user avatar
  • 30.7k
6 votes
3 answers
13k views

Jenkins reports reverse proxy setup incorrect with Apache using virtual hosts with SNI

I'm setting up a Jenkins server, to run under Tomcat behind Apache. I'm using virtual hosts with SSL using SNI so I can access it at https://jenkins.example.com, and serve something else on, say, http:...
Lorin Hochstein's user avatar
4 votes
4 answers
13k views

Upgrading OpenSSL in CentOS 5.3

I want to use one IP to host many domains with individual SSL certificates (requires SNI). In CentOS 5.3, the latest version of OpenSSL I can find an RPM for is 0.9.8e, which does not support SNI. I ...
Lin's user avatar
  • 2,939
4 votes
1 answer
7k views

How to check haproxy sni-based rule with curl?

I made simple HaProxy configuration to pass thorough traffic based on SNI field. Here is my haproxy.cfg defaults log global timeout client 50s timeout client-fin 50s timeout connect ...
Kirill's user avatar
  • 245
3 votes
1 answer
9k views

Does NGINX support SNI or does it not?

EDIT New question: Can NGINX inspect the TLS request to look for SNI like HAProxy (etc) does? According to what I've read around (and I've been told), NGINX should not support SNI and I should go for ...
Morpheu5's user avatar
  • 269
3 votes
1 answer
2k views

Why is "tcp-request content accept" frontend instruction is required for proper HAProxy SNI-based routing?

I've recently tried to set up SNI-based routing on HAProxy for mongodb mongodb+srv protocol connection. I made it working, but it wasn't until I put tcp-request inspect-delay 5s tcp-request content ...
Pavel Klimov's user avatar
2 votes
2 answers
1k views

Windows Vista Wrong Certificate With SNI

I'm setting up SNI on an apache server and I thought things were going well. I have two URLs from different domains that point at the same site. I have one virtual host setup for each with the ...
JamesArmes's user avatar
2 votes
2 answers
3k views

Command line to set up SNI on IIS for Windows 2012

I'm trying to complete the automated build script of my web server, which runs Windows 2012 and has two SSL websites, each with its own digital certificate. I am using SNI, which works fine when I ...
Ads's user avatar
  • 21
1 vote
1 answer
2k views

nginx and SNI: is it possible to automatically resolve SSL certificate by domain name

I need to setup a server that will server same content over SSL using different domain names. The problem is that I need an ability to add new domain names as easily as possible. Assuming that all ...
Ashald's user avatar
  • 25
0 votes
1 answer
498 views

is a wildcard SSL the only option in this multiple VHOST/1IP setup?

I have a web app set up that needs the following SSL encryption: secure.myapp.com -> SSL www.myapp.com/login -> SSL www.myapp.com/signup -> SSL If I'm correct, I could run one SSL ...
solsol's user avatar
  • 1,131
0 votes
3 answers
4k views

Strict SNI matching for Apache

I have multiple SSL vhosts and non-SSL vhosts served from a single server. If one of the non-ssl vhosts is accessed using "https", the first SSL directive is used. Is there some setting to make it so ...
MirroredFate's user avatar