Server Name Indication (SNI) – a journey 2


Today I went on an unusual journey, and it involved paying the price for configuring Microsoft’s web server (specifically, IIS 8.0 and 8.5) with scant regard for why it works the way it does.  Let me start at the beginning..

As of Internet Information Services (IIS) 8.0 (Windows Server 2012) and continuing in the latest version, 8.5 (Windows Server 2012 R2) there is now support for “Server Name Indication”, or SNI.  IIS allows you to set this value when configuring HTTPS site bindings on websites, as per below:

image

“Require Server Name Indication” or “make IIS support multiple SSL/TLS certificates” as I used to call it is a feature of IIS which allows you to bind different digital certificates to different websites within IIS using the same IP address.

Prior to IIS 8.0, you could only bind a single certificate to an individual IP address which you could only bind to one website, due to the way that handshaking worked at the time.  From Wikipedia:

Server Name Indication (SNI) is an extension to the TLS computer networking protocol[1] by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process.

This allows a server to present multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites (or any other Service over TLS) to be served off the same IP address without requiring all those sites to use the same certificate. It is the conceptual equivalent to HTTP/1.1 name-based virtual hosting, but for HTTPS.

Now there’s a caveat with SNI, and one which I did not truly appreciate until today – some older “legacy” browsers, applications and libraries do not support SNI.

No support for SNI

The following combinations do not implement SNI (from Wikipedia again):

Client side
Server side
Libraries
  • Qt client side up to 4.7
  • Mozilla NSS server side
  • Java before 1.7
  • Python 2.x (except 2.7.9), 3.0, 3.1 (ssl, urllib[2] and httplib modules)

This begs the painful question..

What happens when something which does not support SNI tries to call a website or web service which relies on SNI – such as websites hosted within IIS?

Consider what happens when a client which supports SNI makes a request of IIS 8.0 or 8.5:

image

Because the site name indicator is supplied, IIS is able to locate the correct certificate for the named site and return it as part of the TLS handshake (prior to receiving HTTPS headers).  If no named site is found, it will resort to the default certificate/HTTPS binding if there is one – note: you should have a default certificate set!

Now, let’s compare that with what would happen when SNI is not supported by the client:

image
Note: this assumes the default website has the default https/443 bound to it.

Because the initial TLS handshake does not include the server name indicator (the name of the requested site) IIS will default to returning whatever’s bound by default.  This will likely not match the certificate expected!

Some symptoms of clients not supporting SNI:

  • Certificate mismatch (requested URI doesn’t match certificate common name) – default certificate is returned
  • Intended website has no requests logged (but HTTP requests are logged – assuming a http binding is also used!)
  • Intended request is logged against the default site instead of the intended site

One potential solution

If most of your sites use the same domain, you can assign a wildcard certificate to be the default for https/443 binding.  When the non-SNI request arrives, the wildcard will match and then the subsequent HTTPS headers will result in the correct website being accessed:

image

I’m not sure if the sites would have to use the same wildcard certificate or not – this is currently being tested.

Another option

..could be to place a network load balancing (NLB) appliance in front of your webserver, if it supports HTTPS/SSL/TLS offloading.  This way, traffic coming from the NLB would actually be HTTP, not HTTPS.  This is obviously far less secure as the HTTPS traffic would terminate on the load balancer, but it does solve the problem in theory.

Conclusion

Well that was a fun find.  The moral of the story is.. take time to understand why certain settings “make things work”, or else chances are you’ll find out the hard way.  I hope this article helped someone out there.


About Rob Sanders

IT Professional and TOGAF 9 certified architect with nearly two decades of industry experience, 18 years in commercial software development and 11 years in IT consulting. Check out the "About Rob" page for more information.


Leave a comment

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

2 thoughts on “Server Name Indication (SNI) – a journey

  • Geoffrey

    Hello Rob,

    Thank you for this article. It’s very clear.

    What about the part “One potential solution”, you said “I’m not sure if the sites would have to use the same wildcard certificate or not – this is currently being tested.”

    Did you test it then ? This “potential solution” really worked ?

    Thank you,
    Geoffrey

    • Rob Sanders Post author

      We bound wildcard certificates to the sites used by the non-SLI compliant applications and it worked fine. We didn’t test it with the default site serving the wildcard and the target sites with FQDN common names (ran out of time). I have a hunch it would work though.