Questions tagged [sni]
Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address
195
questions
110
votes
5
answers
79k
views
Multiple SSL domains on the same IP address and same port?
This is a Canonical Question about Hosting multiple SSL websites on the same IP.
I was under the impression that each SSL Certificate required it's own unique IP Address/Port combination. But the ...
50
votes
3
answers
99k
views
How can I detect if a server is using SNI for HTTPS?
I'm looking for a simple way to know if a server is using the Server Name Indication SSL extension for its HTTPS certificate on a website. A method that uses either a browser or Unix command line is ...
40
votes
3
answers
135k
views
Setting up default SSL site on IIS8
I have setup few websites on IIS8 all using the same wildcard SSL certificate. Some of the sites need to be accessible to older browsers and operating systems, therefore I cannot use the "Require ...
32
votes
4
answers
35k
views
What is the difference between SAN and SNI SSL certificates?
Could someone explain me the difference between these certificates in a simplified way? I read some articles but it sounds like they do the same job, namely encrypting many domains with one ...
26
votes
4
answers
29k
views
Can a Reverse Proxy use SNI with SSL pass through?
I need to serve several applications over https using one external ip address.
The ssl certificates should not be managed on the reverse proxy. They are installed on the application servers.
Can a ...
21
votes
3
answers
38k
views
"Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile]" error
After recently upgrading Apache2 to version 2.2.31 I found a strange behaviour in SSL VirtualHost setup.
A few of the website I'm hosting were showing the certificate for the default host even if the ...
21
votes
6
answers
17k
views
Redirect to SSL only if browser supports SNI
I have Apache 2.2 with mod_ssl and a bunch of sites in HTTPS on the same IP/port with VirtualHosting, so client must support SNI to connect to those virtual hosts.
I would like to configure my server ...
13
votes
2
answers
8k
views
Using SNI on Windows Server 2012 R2 not working
I am trying to get both my sites running with their seperate certificates on a Windows Server 2012 R2.
Should this not be possible?
On the last added site www.c1get.net I get the certificate from ...
12
votes
1
answer
9k
views
How to define which SSL certificate nginx sends first with SNI?
I use nginx 1.2.7 with OpenSSL 0.9.8o on Debian Squeeze for about 30 domains. On two of them I enabled SSL which works fine on both.
The SSL config is use for both domains:
listen 443 ssl;
...
12
votes
3
answers
16k
views
SNI and wildcard SSL certificates on the same server with IIS
I'd like to host a website that should listen to subdomains (e.g. sub.domain.com) together with multiple websites that live just under a second-level domain (e.g. domain2.com, domain3.com) with IIS ...
11
votes
3
answers
2k
views
Does SNI represent a privacy concern for my website visitors?
Firstly, I'm sorry for my bad English. I'm still learning it. Here it goes:
When I host a single website per IP address, I can use "pure" SSL (without SNI), and the key exchange occurs before the ...
10
votes
2
answers
9k
views
using nginx with SNI
By now I've not used SNI with nginx yet. But as IP address pools are quite filled and commercial XP support is about to cease (finally) I'm thinking about converting a few sites to SNI.
I'm aware of ...
10
votes
2
answers
23k
views
HAProxy with SNI and different SSL Settings
I have HAProxy for my two sites, one of them public and one private.
www.mysite.com
private.mysite.com
Atm, I'm using haproxy like this:
frontend mysite_https
bind *.443 ssl crt /etc/mycert.pem ...
10
votes
2
answers
3k
views
How do I setup multiple subdomains with their own certificate using nginx?
Unless every answer that I've read was plain wrong, SNI should make it possible to do what I want, yet every guide tells me to do exactly what I'm doing.
And yet nginx is serving the wrong ...
10
votes
2
answers
65k
views
Why does apache httpd tell me that my name-based virtualhosts only works with SNI enabled browers (RFC 4366)
Why does apache give me this error message in my logs? Is it a false positive?
[warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
I ...
9
votes
2
answers
2k
views
Can a hardware load-balancer route SSL traffic with SNI?
We've got a webserver farm currently hosting 2 applications - both applications are running on all servers. We want to split this so we have a dedicated server farm for each app (we have good reasons ...
8
votes
3
answers
984
views
Upgrade HTTP connection to SSL/TLS
I currently have a server which automatically redirects all HTTP requests to the equivalent HTTPS site.
The problem is that is seems like some browsers do not accept the SSL certificate (StartSSL.com) ...
8
votes
2
answers
5k
views
Have Nginx reject unknown server names over HTTPS
I have an Nginx instance using SNI to serve multiple HTTPS domains from a single IP.
The only glitch with the setup is that Nginx responds with the first (acting as default) domain whenever a URL for ...
8
votes
1
answer
2k
views
SNI for a SMTP server
Let's say I have a dedicated server with some IP (IP1). I'm redirecting multiple domains (say example.com, example.net) to that IP via DNS.
I've a single nginx server running here, and I've set up SNI ...
8
votes
1
answer
8k
views
IIS 8 - Default SSL Site Breaks SNI
We have the following scenario in testing SNI on Windows Server 2012 R2 with IIS 8. Domain names and IP addresses listed below are fake and for example only.
WEB SITE NAME IP ADDRESS Host ...
7
votes
3
answers
26k
views
No need to enable SNI for multiple SSL sites on same IP but using same wild card certificate?
I have an IIS server hosting:
example.com/www.example.com
sub1.example.com
sub2.example.com
They are listed as 3 separate sites under IIS, all bind to the same IP over HTTPS on 443. But they all use ...
7
votes
2
answers
4k
views
How to stop HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (Apache-SNI)
I hope that title is clear.
How do I prevent HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (setup is Apache-SNI).
For example, using my abbreviated ...
7
votes
3
answers
5k
views
What percentage of web users are running on browsers/OSes that support SNI? [closed]
Has anyone done any analysis (or know where I can find some!) on what proportion of internet users are using a browser/operating system combination that support SNI (Server Name Indication) SSL/TLS ...
7
votes
2
answers
9k
views
Enabling OCSP stapling on IIS SNI-enabled site
If Require Server Name Indication is checked on the binding of an IIS site, OCSP stapling is disabled for the site.
This is easily confirmed by enabling SNI for a site that currently doesn't require ...
7
votes
4
answers
22k
views
Apache SNI namevhosts always route to first VirtualHost entry
Apache seems to route all https requests to the first <VirtualHost *:443> regardless of SNI matching on ServerName/ServerAlias fields.
Apache is built with SNI
Server version: Apache/2.2.22 (...
6
votes
1
answer
13k
views
HTTP status code to signal bad or missing Host header
Is there an HTTP status code which is appropriate to use for clients which send a bad hostname (or none at all) through SNI or the HTTP Host header?
An older question address how and why such ...
6
votes
3
answers
13k
views
Jenkins reports reverse proxy setup incorrect with Apache using virtual hosts with SNI
I'm setting up a Jenkins server, to run under Tomcat behind Apache. I'm using virtual hosts with SSL using SNI so I can access it at https://jenkins.example.com, and serve something else on, say, http:...
6
votes
4
answers
5k
views
What happens when a browser does not support SNI
A seemingly simple question, but valid nonetheless.
What exactly happens when a browser which does not support SNI attempts to visit a site configured to force SSL via SNI.
Thanks
6
votes
1
answer
2k
views
Is it possible to disable clients not supporting SNI in nginx?
By default nginx serves https requests with multiple certificates by using SNI. The fallback for clients not supporting SNI will be the default_server or first vhost which has been configured.
I want ...
6
votes
1
answer
1k
views
Apache Remote proxy for a reverse proxy SNI mismatch
Having an issue with our setup of an Apache-2.2 and a reverse proxy which is proxied to via another device.
flow is:
Apache A -> proxy.abc.net -> Apache B
The error we get on Apache B is
Hostname ...
5
votes
2
answers
12k
views
Disabling SNI for specific virtualhost on Apache
We have a web server with a couple of internet IPs.
I have successfully set up SNI name based virtualhosts, it's working great. What I'd like to do though is have our main site NOT use SNI and use ...
5
votes
1
answer
16k
views
How to get HAProxy to route TCP based on SNI (using openssl s_client to test)?
I want to use HAProxy to terminate TLS-encrypted TCP connnections and to pass the unencrypted TCP traffic to various backends based on the Server Name Indication used to initiate the TLS connection.
...
5
votes
0
answers
304
views
Do modern web browsers always send the web server's hostname in the SNI extension header?
When a web browser that supports Server Name Indication (SNI) connects to an HTTPS site, does it ALWAYS send the hostname in the SNI field?
That is, there is no way for a web browser to know if the ...
4
votes
3
answers
3k
views
Problems with multiple SSL on same IP, but only in select clients
I know there are tons of posts about multiple SSL on same IP, but I promise I'm not beating a dead horse. My question is very clear. First, a little background...
Our organization has several ...
4
votes
1
answer
11k
views
How to check apache for SNI (Server Name Indication ) availability?
I have a centos 7 server. I switched from apache 2.4.6 to apache 2.4.25 using IUS repository (https://ius.io/). My goal is to support multiple SSL certificates with a single IP.
I have installed:
...
4
votes
1
answer
3k
views
Apache2 conditional section based on port
I don't know much about if statements in apache configuration, and I'm wondering if I can have a section of the configuration applied only if the request is received on a certain port.
In short, this ...
4
votes
1
answer
3k
views
Nginx default SSL Host: Disable completely or...?
I have many SSL Hosts on my server serving via Nginx SNI.
However, when I enter the IP address of that server, I will see the first configured virtual host with a certificate warning.
Is it possible ...
4
votes
2
answers
2k
views
nginx, multiple domains, ssl support for clients without SNI
I want to support SSL for clients which lack of SNI support (IE/FF/Safari on win XP, Android < 2.2, and others).
The solution I picked was to have nginx listen on separate port for each ...
4
votes
1
answer
9k
views
Is it possible to get a wildcard cert and use SNI?
I'd like to make setting up new subdomains easy (at least for the development side) and getting one wildcard cert, setting up a wildcard dns (which is done and works great) and setting up SNI (Server ...
4
votes
1
answer
7k
views
How to check haproxy sni-based rule with curl?
I made simple HaProxy configuration to pass thorough traffic based on SNI field. Here is my haproxy.cfg
defaults
log global
timeout client 50s
timeout client-fin 50s
timeout connect ...
4
votes
1
answer
11k
views
Transparent HTTP/HTTPS domain filtering proxy [closed]
I want to set up a transparent HTTP/HTTPS proxy to filter outbound requests based on destination hostname (domain). The proxy itself should be non-intrusive and just forward traffic, not decrypt/...
4
votes
1
answer
2k
views
Nginx: SNI doesn't work for server_name with multiple arguments
With this Nginx config:
server {
listen 443 ssl;
server_name www.x.nl x.nl;
ssl_certificate /etc/nginx/ssl/x.nl.crtkeyca;
ssl_certificate_key /etc/nginx/ssl/x.nl.crtkeyca;
[...]...
4
votes
1
answer
2k
views
For enabling SSL for a single domain on a server with muliple vhosts, will this configuration work?
I just purchased an SSL certificate to secure/enable only ONE domain on a server with multiple vhosts. I plan on configuring as shown below (non SNI). In addition, I still want to access phpMyAdmin, ...
4
votes
1
answer
3k
views
Stunnel with SNI: Section *name*: SNI section name not found
Im trying to use stunnel with 2 domains on the same IP.
My conf is this:
;key = /etc/ssl/private/namecheap/server.key
# See this link http://www.sysadminworld.com/2011/how-do-i-use-an-intermediate-...
4
votes
1
answer
3k
views
SNI error over SSL on some Android devices
I am getting an SNI error:
Hostname X provided via SNI, but no hostname provided in HTTP request
On some Android phones when making SSL requests to my domain. This is despite ensuring that the Host ...
4
votes
4
answers
13k
views
Upgrading OpenSSL in CentOS 5.3
I want to use one IP to host many domains with individual SSL certificates (requires SNI). In CentOS 5.3, the latest version of OpenSSL I can find an RPM for is 0.9.8e, which does not support SNI.
I ...
3
votes
1
answer
2k
views
Why is "tcp-request content accept" frontend instruction is required for proper HAProxy SNI-based routing?
I've recently tried to set up SNI-based routing on HAProxy for mongodb mongodb+srv protocol connection.
I made it working, but it wasn't until I put
tcp-request inspect-delay 5s
tcp-request content ...
3
votes
1
answer
7k
views
Nginx and https - Specifying an ip address as a server_name gives the correct website but the wrong certificate
I want to run this url: https://192.168.1.254 and get a website with the correct content and certificate in the address bar. I am getting the website but I get an invalid certificate error in the ...
3
votes
1
answer
395
views
Resolve a many-SSL-to-one IP for clients browsers that doesn't support SNI
Whoa, acronyms :) So according to this question you can have multiple SSL subdomains on one IP address as long as your server supports TLS (which Apache 2.2x does).
Another answer to that question ...
3
votes
2
answers
2k
views
Scalable way to install SSL certificates without downtime
We have a SaaS application that allows customers to use their own domain – pretty typical. At its core, the architecture has a simple catch-all virtual host (apache) and the software does the work of ...