Server Name Indication

One of the most common method of encrypting a stream-oriented communication session is the Transport Layer Security (TLS) protocol. It is used, for example, when somebody types "https" in their browser.

In order to guarantee that the site to which the user wanted to connect is actually the site to which the browser connected, TLS compares the user entered host part of the URI with the common name (CN) from the server provided certificate. Should the comparison fail, the browser will warn the user that there is something wrong with the certificate of the site.

Due to the fact that this comparison is done in the early stages of the TLS negotiation, the client receives the server's CN before information which is required to implement virtual hosting (such as the HTTP "host" header) is sent to the server. Therefore, it is impossible to implement secure virtual hosting without having the browser warn the user.

An extension to TLS called Server Name Indication (SNI) addresses this issue by sending the name of the virtual host as part of the TLS negotiation [ [http://journal.paul.querna.org/articles/2005/04/24/tls-server-name-indication/ Paul’s Journal » Blog Archive » TLS Server Name Indication ] ] . This enables the server to "switch" to the correct virtual host early and present the browser with the certificate containing the correct CN.

Support

Browsers

Browsers with support for TLS server name indication [ [https://sni.velox.ch/ TLS SNI Test Site: alice.sni.velox.ch ] ] :
* Mozilla Firefox 2.0 or later
* Opera 8.0 or later (the TLS 1.1 protocol must be enabled)
* Internet Explorer 7 or later
* Google Chrome

Servers

* Apache 2.2.8+ with mod_ssl
* Apache with experimental mod_gnutls
* Cherokee if compiled with TLS support
* New versions of lighttpd 1.4.x and 1.5.x [ [http://trac.lighttpd.net/trac/ticket/386 #386 (TLS servername extension (SNI) for namebased TLS-vhosts) - lighttpd - Trac] ]
* Nginx with an accompanying OpenSSL built with SNI support

Unsupported Operating Systems and Browsers

The following combinations do not support SNI.
* Windows XP and Internet Explorer 6 or 7
* Mac OSX and Safari 3

References

External links

* [http://www.ietf.org/rfc/rfc3546.txt RFC3546]