Skip to main content
48 votes
Accepted

What is the difference between SAN and SNI SSL certificates?

SAN (Subject Alternative Name) is part of the X509 certificate spec, where the certificate has a field with a list of alternative names that are also valid for the subject (in addition to the single ...
Håkan Lindqvist's user avatar
41 votes

How can I detect if a server is using SNI for HTTPS?

The one liner you are probably looking for to detect the presence of a SSL/TLS Server Name Indication extension header is: openssl s_client -servername www.SERVERNAME.com -tlsextdebug -connect www....
M12's user avatar
  • 511
21 votes

What is the difference between SAN and SNI SSL certificates?

SAN stands for Subject Alternative Name, and it's an x509 certificate property, and SNI is a feature that the SSL/TLS client can support, thus a totally different entity. Using a certificate with SAN ...
drookie's user avatar
  • 8,821
17 votes
Accepted

HTTP status code to signal bad or missing Host header

RFC 6066 doesn't specify or even recommend any particular HTTP error in the case that the hostname sent via SNI doesn't match the HTTP Host header. It does recommend that the server abort the TLS ...
Michael Hampton's user avatar
12 votes
Accepted

How do I setup multiple subdomains with their own certificate using nginx?

listen 443 ssl default_server; listen [::]:443 ssl; The first line enables listening on port 443 on IPv4. The second line covers IPv6 only. Since you have only a single listen 443 (IPv4) ...
Steffen Ullrich's user avatar
10 votes
Accepted

Can a hardware load-balancer route SSL traffic with SNI?

According to their website, F5 load balancers have support for SNI : https://devcentral.f5.com/articles/ssl-profiles-part-7-server-name-indication You can even make iRules based on SNI. Disclaimer :...
bgtvfr's user avatar
  • 1,272
9 votes

Can a hardware load-balancer route SSL traffic with SNI?

can't the router examine the SNI header, A router usually works only at OSI layer 3, i.e. does not inspect the contents of the packet but only the target IP. For routing based on SNI an understanding ...
Steffen Ullrich's user avatar
8 votes

Can a Reverse Proxy use SNI with SSL pass through?

This is certainly possible, even now in 2021 with more and more widespread TLS 1.3! Many web servers or specialized reverse proxies provide this functionality out of the box: Nginx ≥ 1.11.5 (Debian ≥ ...
vog's user avatar
  • 587
8 votes
Accepted

How to check apache for SNI (Server Name Indication ) availability?

The stock CentOS httpd & mod_ssl packages would already have supported SNI. SNI has been supported by openssl since version 0.9.8f and any httpd since version 2.2.12 built with openssl 0.9.8f and ...
HBruijn's user avatar
  • 80.8k
8 votes
Accepted

SNI for a SMTP server

SNI is not needed here. The verification of the certificate host name is performed against the hostname returned by the MX record, not the domain name in the target email address. So as long as you ...
Jenny D's user avatar
  • 28.1k
7 votes
Accepted

No need to enable SNI for multiple SSL sites on same IP but using same wild card certificate?

The rule of thumb is that at HTTP API level, You can bind a single certificate to IP:443 as IP based mapping. You can bind a certificate to domain:443 as SNI mapping. Such mappings can be ...
Lex Li's user avatar
  • 1,323
7 votes

How to get HAProxy to route TCP based on SNI (using openssl s_client to test)?

The answer is to use ssl_fc_sni, instead of req.ssl_sni. The former is for SSL-terminated sessions, whereas the latter is for sessions where TCP is passed straight through.
John's user avatar
  • 293
6 votes

What is the difference between SAN and SNI SSL certificates?

This mixes two parts of the certificate process. A SAN is a Subject Alternative Name. It is a way to create one certificate for multiple domains. You simply add the other domains you want a ...
Christopher Perrin's user avatar
6 votes
Accepted

Apache2 conditional section based on port

Yes, starting from Apache 2.4, you can use <If "%{HTTPS} == 'on'"> # HTTPS-specific configuration here </If> in your configuration file. Many other expressions inside the <If "...
黄雨伞's user avatar
  • 176
5 votes

IIS 8 - Default SSL Site Breaks SNI

I think if you change the IP address for the somedomain.com binding to "All unassigned" rather than 10.10.0.1, it will stop getting in the way of your SNI sites [surprisingly].
franzo's user avatar
  • 223
5 votes

Can NGINX inspect the TLS request to look for SNI like HAProxy (etc) does?

The ngx_stream_ssl_preread_module module is available as of Nginx 1.11.5 and seems to do just this. It allows access to the SNI server name found in the client's ClientHello message via the $...
Jamie's user avatar
  • 51
5 votes

HAProxy with SNI and different SSL Settings

recent versions of haproxy support a setting called crt-list which allows you to specify different TLS settings based on the matched certificate you can use it like this: haproxy.conf: frontend ...
freaker's user avatar
  • 151
5 votes
Accepted

Nginx responds with 200 even when HTTP HOST header is different from SNI

A HTTP connection is just a TCP connection at the end of the day. So the above is actually fine for HTTP connections (i.e. if you connect to www.a.com, you are actually connecting to an IP address and ...
Barry Pollard's user avatar
5 votes
Accepted

Nginx and https - Specifying an ip address as a server_name gives the correct website but the wrong certificate

... SNI apparently does not allow a Literal IPv4 and IPv6 addresses as a "HostName". But is that really the case? The idea behind SNI is to distinguish between multiple domains on the same ...
Steffen Ullrich's user avatar
5 votes
Accepted

Why is "tcp-request content accept" frontend instruction is required for proper HAProxy SNI-based routing?

I will try to answer my own question after giving it some thought. So, HAProxy docs also have the following mention: http://cbonte.github.io/haproxy-dconv/2.0/configuration.html If content switching ...
Pavel Klimov's user avatar
4 votes

Can a Reverse Proxy use SNI with SSL pass through?

Be aware that if the target servers use the same certificate (which is not very unlikely when wildcard certificates are in use), then HTTP/2 can not be used. It will route your traffic to the wrong ...
turbophi's user avatar
4 votes

Upgrade Windows Server 2008R2 to support SNI

SNI is not supported in IIS 7.5, and you can't upgrade IIS, because each version of Windows Server comes with its own version of IIS, which can't be changed. You need at least IIS 8, so you need to ...
Massimo's user avatar
  • 71.5k
4 votes

TLS/SSL - Does SNI Have a Limit on Number of Domains Running on Nginx?

SNI is essentially the same as the Host header in HTTP. The main difference is that the Host header is only inside the HTTP request and thus can only be seen by the web server after the TLS handshake ...
Steffen Ullrich's user avatar
4 votes
Accepted

How to check haproxy sni-based rule with curl?

Figured it out. cURL request is absolutely correct. There were 2 configuration statements missing in haproxy.cfg. In order to make sni-rules work you also need: tcp-request inspect-delay 5s tcp-...
Kirill's user avatar
  • 245
4 votes
Accepted

Generic SNI-based transparent TLS proxy without having to enumerate all backends?

I ended up using nginx with the stream SSL preread module. The configuration is dead simple: stream { server { resolver 127.0.0.1; listen 443; ssl_preread on; ...
András Korn's user avatar
3 votes
Accepted

haproxy logging of req.ssl_sni

Using capture before accept solved it for me. frontend https-in mode tcp tcp-request inspect-delay 3s tcp-request content capture req.ssl_sni len 10 log-format "capture0: %[capture.req.hdr(0)]...
DTT's user avatar
  • 46
3 votes

Enabling OCSP stapling on IIS SNI-enabled site

According to Microsoft this behavior is disabled by default, because of potential performance issues. To enable OCSP stapling for SNI and CCS bindings, locate the following registry subkey: "...
Jim Wolff's user avatar
  • 161
3 votes

How do I setup multiple subdomains with their own certificate using nginx?

It apparently has something to do with the IPv6 listen syntax. When I change listen [::]:443 ssl; to listen 443 ssl; Then it works. I don't know why this is and would welcome other answers with ...
Wayne Werner's user avatar
3 votes
Accepted

How to use AD CS to auto-renew certs for securing IIS websites that use SNI?

You can't expect the CA to permit IIS to enrol for a certificate for all your SNI sites and the CA doesn't know that you own those names. If the CA issues certificates for any Subject the client ...
garethTheRed's user avatar
  • 4,874

Only top scored, non community-wiki answers of a minimum length are eligible