Questions tagged [sni]

Server Name Indication(SNI) is an extension of Transport Layer Security which allows multiple secure web sites, with separate certificates, to be hosted at the same IP address

Filter by
Sorted by
Tagged with
110 votes
5 answers
79k views

Multiple SSL domains on the same IP address and same port?

This is a Canonical Question about Hosting multiple SSL websites on the same IP. I was under the impression that each SSL Certificate required it's own unique IP Address/Port combination. But the ...
learningtech's user avatar
  • 7,445
50 votes
3 answers
99k views

How can I detect if a server is using SNI for HTTPS?

I'm looking for a simple way to know if a server is using the Server Name Indication SSL extension for its HTTPS certificate on a website. A method that uses either a browser or Unix command line is ...
spookylukey's user avatar
40 votes
3 answers
135k views

Setting up default SSL site on IIS8

I have setup few websites on IIS8 all using the same wildcard SSL certificate. Some of the sites need to be accessible to older browsers and operating systems, therefore I cannot use the "Require ...
Emil's user avatar
  • 501
32 votes
4 answers
35k views

What is the difference between SAN and SNI SSL certificates?

Could someone explain me the difference between these certificates in a simplified way? I read some articles but it sounds like they do the same job, namely encrypting many domains with one ...
AFA Med's user avatar
  • 617
26 votes
4 answers
29k views

Can a Reverse Proxy use SNI with SSL pass through?

I need to serve several applications over https using one external ip address. The ssl certificates should not be managed on the reverse proxy. They are installed on the application servers. Can a ...
user319862's user avatar
21 votes
3 answers
38k views

"Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile]" error

After recently upgrading Apache2 to version 2.2.31 I found a strange behaviour in SSL VirtualHost setup. A few of the website I'm hosting were showing the certificate for the default host even if the ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
21 votes
6 answers
17k views

Redirect to SSL only if browser supports SNI

I have Apache 2.2 with mod_ssl and a bunch of sites in HTTPS on the same IP/port with VirtualHosting, so client must support SNI to connect to those virtual hosts. I would like to configure my server ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
13 votes
2 answers
8k views

Using SNI on Windows Server 2012 R2 not working

I am trying to get both my sites running with their seperate certificates on a Windows Server 2012 R2. Should this not be possible? On the last added site www.c1get.net I get the certificate from ...
Poul K. Sørensen's user avatar
12 votes
1 answer
9k views

How to define which SSL certificate nginx sends first with SNI?

I use nginx 1.2.7 with OpenSSL 0.9.8o on Debian Squeeze for about 30 domains. On two of them I enabled SSL which works fine on both. The SSL config is use for both domains: listen 443 ssl; ...
cider's user avatar
  • 129
12 votes
3 answers
16k views

SNI and wildcard SSL certificates on the same server with IIS

I'd like to host a website that should listen to subdomains (e.g. sub.domain.com) together with multiple websites that live just under a second-level domain (e.g. domain2.com, domain3.com) with IIS ...
Piedone's user avatar
  • 395
11 votes
3 answers
2k views

Does SNI represent a privacy concern for my website visitors?

Firstly, I'm sorry for my bad English. I'm still learning it. Here it goes: When I host a single website per IP address, I can use "pure" SSL (without SNI), and the key exchange occurs before the ...
pagliuca's user avatar
  • 243
10 votes
2 answers
9k views

using nginx with SNI

By now I've not used SNI with nginx yet. But as IP address pools are quite filled and commercial XP support is about to cease (finally) I'm thinking about converting a few sites to SNI. I'm aware of ...
justlovingIT's user avatar
10 votes
2 answers
23k views

HAProxy with SNI and different SSL Settings

I have HAProxy for my two sites, one of them public and one private. www.mysite.com private.mysite.com Atm, I'm using haproxy like this: frontend mysite_https bind *.443 ssl crt /etc/mycert.pem ...
mohrphium's user avatar
  • 645
10 votes
2 answers
3k views

How do I setup multiple subdomains with their own certificate using nginx?

Unless every answer that I've read was plain wrong, SNI should make it possible to do what I want, yet every guide tells me to do exactly what I'm doing. And yet nginx is serving the wrong ...
Wayne Werner's user avatar
10 votes
2 answers
65k views

Why does apache httpd tell me that my name-based virtualhosts only works with SNI enabled browers (RFC 4366)

Why does apache give me this error message in my logs? Is it a false positive? [warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366) I ...
Arlukin's user avatar
  • 1,233
9 votes
2 answers
2k views

Can a hardware load-balancer route SSL traffic with SNI?

We've got a webserver farm currently hosting 2 applications - both applications are running on all servers. We want to split this so we have a dedicated server farm for each app (we have good reasons ...
potomato's user avatar
  • 101
8 votes
3 answers
984 views

Upgrade HTTP connection to SSL/TLS

I currently have a server which automatically redirects all HTTP requests to the equivalent HTTPS site. The problem is that is seems like some browsers do not accept the SSL certificate (StartSSL.com) ...
foxylion's user avatar
  • 193
8 votes
2 answers
5k views

Have Nginx reject unknown server names over HTTPS

I have an Nginx instance using SNI to serve multiple HTTPS domains from a single IP. The only glitch with the setup is that Nginx responds with the first (acting as default) domain whenever a URL for ...
Carlton Gibson's user avatar
8 votes
1 answer
2k views

SNI for a SMTP server

Let's say I have a dedicated server with some IP (IP1). I'm redirecting multiple domains (say example.com, example.net) to that IP via DNS. I've a single nginx server running here, and I've set up SNI ...
xryl669's user avatar
  • 238
8 votes
1 answer
8k views

IIS 8 - Default SSL Site Breaks SNI

We have the following scenario in testing SNI on Windows Server 2012 R2 with IIS 8. Domain names and IP addresses listed below are fake and for example only. WEB SITE NAME IP ADDRESS Host ...
Beems's user avatar
  • 294
7 votes
3 answers
26k views

No need to enable SNI for multiple SSL sites on same IP but using same wild card certificate?

I have an IIS server hosting: example.com/www.example.com sub1.example.com sub2.example.com They are listed as 3 separate sites under IIS, all bind to the same IP over HTTPS on 443. But they all use ...
thankyoussd's user avatar
7 votes
2 answers
4k views

How to stop HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (Apache-SNI)

I hope that title is clear. How do I prevent HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (setup is Apache-SNI). For example, using my abbreviated ...
Jeff's user avatar
  • 1,426
7 votes
3 answers
5k views

What percentage of web users are running on browsers/OSes that support SNI? [closed]

Has anyone done any analysis (or know where I can find some!) on what proportion of internet users are using a browser/operating system combination that support SNI (Server Name Indication) SSL/TLS ...
Paul Russell's user avatar
7 votes
2 answers
9k views

Enabling OCSP stapling on IIS SNI-enabled site

If Require Server Name Indication is checked on the binding of an IIS site, OCSP stapling is disabled for the site. This is easily confirmed by enabling SNI for a site that currently doesn't require ...
franzo's user avatar
  • 223
7 votes
4 answers
22k views

Apache SNI namevhosts always route to first VirtualHost entry

Apache seems to route all https requests to the first <VirtualHost *:443> regardless of SNI matching on ServerName/ServerAlias fields. Apache is built with SNI Server version: Apache/2.2.22 (...
arcyqwerty's user avatar
6 votes
1 answer
13k views

HTTP status code to signal bad or missing Host header

Is there an HTTP status code which is appropriate to use for clients which send a bad hostname (or none at all) through SNI or the HTTP Host header? An older question address how and why such ...
kasperd's user avatar
  • 30.7k
6 votes
3 answers
13k views

Jenkins reports reverse proxy setup incorrect with Apache using virtual hosts with SNI

I'm setting up a Jenkins server, to run under Tomcat behind Apache. I'm using virtual hosts with SSL using SNI so I can access it at https://jenkins.example.com, and serve something else on, say, http:...
Lorin Hochstein's user avatar
6 votes
4 answers
5k views

What happens when a browser does not support SNI

A seemingly simple question, but valid nonetheless. What exactly happens when a browser which does not support SNI attempts to visit a site configured to force SSL via SNI. Thanks
PUncle's user avatar
  • 63
6 votes
1 answer
2k views

Is it possible to disable clients not supporting SNI in nginx?

By default nginx serves https requests with multiple certificates by using SNI. The fallback for clients not supporting SNI will be the default_server or first vhost which has been configured. I want ...
Matthias's user avatar
  • 193
6 votes
1 answer
1k views

Apache Remote proxy for a reverse proxy SNI mismatch

Having an issue with our setup of an Apache-2.2 and a reverse proxy which is proxied to via another device. flow is: Apache A -> proxy.abc.net -> Apache B The error we get on Apache B is Hostname ...
greyhathero's user avatar
5 votes
2 answers
12k views

Disabling SNI for specific virtualhost on Apache

We have a web server with a couple of internet IPs. I have successfully set up SNI name based virtualhosts, it's working great. What I'd like to do though is have our main site NOT use SNI and use ...
John Hunt's user avatar
  • 429
5 votes
1 answer
16k views

How to get HAProxy to route TCP based on SNI (using openssl s_client to test)?

I want to use HAProxy to terminate TLS-encrypted TCP connnections and to pass the unencrypted TCP traffic to various backends based on the Server Name Indication used to initiate the TLS connection. ...
John's user avatar
  • 293
5 votes
0 answers
304 views

Do modern web browsers always send the web server's hostname in the SNI extension header?

When a web browser that supports Server Name Indication (SNI) connects to an HTTPS site, does it ALWAYS send the hostname in the SNI field? That is, there is no way for a web browser to know if the ...
Phillip Stewart's user avatar
4 votes
3 answers
3k views

Problems with multiple SSL on same IP, but only in select clients

I know there are tons of posts about multiple SSL on same IP, but I promise I'm not beating a dead horse. My question is very clear. First, a little background... Our organization has several ...
Calvin Froedge's user avatar
4 votes
1 answer
11k views

How to check apache for SNI (Server Name Indication ) availability?

I have a centos 7 server. I switched from apache 2.4.6 to apache 2.4.25 using IUS repository (https://ius.io/). My goal is to support multiple SSL certificates with a single IP. I have installed: ...
GeorgeKaf's user avatar
  • 175
4 votes
1 answer
3k views

Apache2 conditional section based on port

I don't know much about if statements in apache configuration, and I'm wondering if I can have a section of the configuration applied only if the request is received on a certain port. In short, this ...
Waleed Hamra's user avatar
4 votes
1 answer
3k views

Nginx default SSL Host: Disable completely or...?

I have many SSL Hosts on my server serving via Nginx SNI. However, when I enter the IP address of that server, I will see the first configured virtual host with a certificate warning. Is it possible ...
lockdoc's user avatar
  • 241
4 votes
2 answers
2k views

nginx, multiple domains, ssl support for clients without SNI

I want to support SSL for clients which lack of SNI support (IE/FF/Safari on win XP, Android < 2.2, and others). The solution I picked was to have nginx listen on separate port for each ...
Tzury Bar Yochay's user avatar
4 votes
1 answer
9k views

Is it possible to get a wildcard cert and use SNI?

I'd like to make setting up new subdomains easy (at least for the development side) and getting one wildcard cert, setting up a wildcard dns (which is done and works great) and setting up SNI (Server ...
Sheldon McGee's user avatar
4 votes
1 answer
7k views

How to check haproxy sni-based rule with curl?

I made simple HaProxy configuration to pass thorough traffic based on SNI field. Here is my haproxy.cfg defaults log global timeout client 50s timeout client-fin 50s timeout connect ...
Kirill's user avatar
  • 245
4 votes
1 answer
11k views

Transparent HTTP/HTTPS domain filtering proxy [closed]

I want to set up a transparent HTTP/HTTPS proxy to filter outbound requests based on destination hostname (domain). The proxy itself should be non-intrusive and just forward traffic, not decrypt/...
Cybran's user avatar
  • 422
4 votes
1 answer
2k views

Nginx: SNI doesn't work for server_name with multiple arguments

With this Nginx config: server { listen 443 ssl; server_name www.x.nl x.nl; ssl_certificate /etc/nginx/ssl/x.nl.crtkeyca; ssl_certificate_key /etc/nginx/ssl/x.nl.crtkeyca; [...]...
Willem's user avatar
  • 2,922
4 votes
1 answer
2k views

For enabling SSL for a single domain on a server with muliple vhosts, will this configuration work?

I just purchased an SSL certificate to secure/enable only ONE domain on a server with multiple vhosts. I plan on configuring as shown below (non SNI). In addition, I still want to access phpMyAdmin, ...
user1322092's user avatar
4 votes
1 answer
3k views

Stunnel with SNI: Section *name*: SNI section name not found

Im trying to use stunnel with 2 domains on the same IP. My conf is this: ;key = /etc/ssl/private/namecheap/server.key # See this link http://www.sysadminworld.com/2011/how-do-i-use-an-intermediate-...
dasdasd's user avatar
  • 141
4 votes
1 answer
3k views

SNI error over SSL on some Android devices

I am getting an SNI error: Hostname X provided via SNI, but no hostname provided in HTTP request On some Android phones when making SSL requests to my domain. This is despite ensuring that the Host ...
JordanC's user avatar
  • 141
4 votes
4 answers
13k views

Upgrading OpenSSL in CentOS 5.3

I want to use one IP to host many domains with individual SSL certificates (requires SNI). In CentOS 5.3, the latest version of OpenSSL I can find an RPM for is 0.9.8e, which does not support SNI. I ...
Lin's user avatar
  • 2,939
3 votes
1 answer
2k views

Why is "tcp-request content accept" frontend instruction is required for proper HAProxy SNI-based routing?

I've recently tried to set up SNI-based routing on HAProxy for mongodb mongodb+srv protocol connection. I made it working, but it wasn't until I put tcp-request inspect-delay 5s tcp-request content ...
Pavel Klimov's user avatar
3 votes
1 answer
7k views

Nginx and https - Specifying an ip address as a server_name gives the correct website but the wrong certificate

I want to run this url: https://192.168.1.254 and get a website with the correct content and certificate in the address bar. I am getting the website but I get an invalid certificate error in the ...
FlexMcMurphy's user avatar
3 votes
1 answer
395 views

Resolve a many-SSL-to-one IP for clients browsers that doesn't support SNI

Whoa, acronyms :) So according to this question you can have multiple SSL subdomains on one IP address as long as your server supports TLS (which Apache 2.2x does). Another answer to that question ...
Kyle Cureau's user avatar
  • 1,537
3 votes
2 answers
2k views

Scalable way to install SSL certificates without downtime

We have a SaaS application that allows customers to use their own domain – pretty typical. At its core, the architecture has a simple catch-all virtual host (apache) and the software does the work of ...
jpschroeder's user avatar