SNI

Simple definition

SNI allows you to indicate the targeted domain name at the beginning of a TLS connection.

Technical definition

Server Name specification is a TLS extension sent by the client so that a server hosting multiple sites chooses the right certificate.

What’s the point?.

host multiple HTTPS sites on the same IP address.

Concrete example

a reverse proxy selects the certificate of example.fr with the SNI.

Common problems

• former client without SNI
• default certificate returned
• different SNI name from HTTP Host

To be noted: Always adapt the diagnosis to the version of the product and to the architecture actually deployed.