Category Archives : Programming

This category is designed for entries which relate to software development


Server Name Indication (SNI) – a journey

Today I went on an unusual journey, and it involved paying the price for configuring Microsoft’s web server (specifically, IIS 8.0 and 8.5) with scant regard for why it works the way it does.  Let me start at the beginning..

As of Internet Information Services (IIS) 8.0 (Windows Server 2012) and continuing in the latest version, 8.5 (Windows Server 2012 R2) there is now support for “Server Name Indication”, or SNI.  IIS allows you to set this value when configuring HTTPS site bindings on websites, as per below:

image

“Require Server Name Indication” or “make IIS support multiple SSL/TLS certificates” as I used to call it is a feature of IIS which allows you to bind different digital certificates to different websites within IIS using the same IP address.

Prior to IIS 8.0, you could only bind a single certificate to an individual IP address which you could only bind to one website, due to the way that handshaking worked at the time.  From Wikipedia:

Server Name Indication (SNI) is an extension to the TLS computer networking protocol[1] by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process.

This allows a server to present multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites (or any other Service over TLS) to be served off the same IP address without requiring all those sites to use the same certificate. It is the conceptual equivalent to HTTP/1.1 name-based virtual hosting, but for HTTPS.

Now there’s a caveat with SNI, and one which I did not truly appreciate until today – some older “legacy” browsers, applications and libraries do not support SNI.

No support for SNI

The following combinations do not implement SNI (from Wikipedia again):

Client side
Server side
Libraries
  • Qt client side up to 4.7
  • Mozilla NSS server side
  • Java before 1.7
  • Python 2.x (except 2.7.9), 3.0, 3.1 (ssl, urllib[2] and httplib modules)

This begs the painful question..

What happens when something which does not support SNI tries to call a website or web service which relies on SNI – such as websites hosted within IIS?

Consider what happens when a client which supports SNI makes a request of IIS 8.0 or 8.5:

image

Because the site name indicator is supplied, IIS is able to locate the correct certificate for the named site and return it as part of the TLS handshake (prior to receiving HTTPS headers).  If no named site is found, it will resort to the default certificate/HTTPS binding if there is one – note: you should have a default certificate set!

Now, let’s compare that with what would happen when SNI is not supported by the client:

image
Note: this assumes the default website has the default https/443 bound to it.

Because the initial TLS handshake does not include the server name indicator (the name of the requested site) IIS will default to returning whatever’s bound by default.  This will likely not match the certificate expected!

Some symptoms of clients not supporting SNI:

  • Certificate mismatch (requested URI doesn’t match certificate common name) – default certificate is returned
  • Intended website has no requests logged (but HTTP requests are logged – assuming a http binding is also used!)
  • Intended request is logged against the default site instead of the intended site

One potential solution

If most of your sites use the same domain, you can assign a wildcard certificate to be the default for https/443 binding.  When the non-SNI request arrives, the wildcard will match and then the subsequent HTTPS headers will result in the correct website being accessed:

image

I’m not sure if the sites would have to use the same wildcard certificate or not – this is currently being tested.

Another option

..could be to place a network load balancing (NLB) appliance in front of your webserver, if it supports HTTPS/SSL/TLS offloading.  This way, traffic coming from the NLB would actually be HTTP, not HTTPS.  This is obviously far less secure as the HTTPS traffic would terminate on the load balancer, but it does solve the problem in theory.

Conclusion

Well that was a fun find.  The moral of the story is.. take time to understand why certain settings “make things work”, or else chances are you’ll find out the hard way.  I hope this article helped someone out there.


Remembering Terry Pratchett

“Tech-savvy admirers of the late Terry Pratchett have hit upon an idea for a particularly appropriate memorial. It will be everywhere and nowhere, hiding in the code of the internet.

Pratchett’s 33rd Discworld novel, Going Postal, tells of the creation of an internet-like system of communication towers called “the clacks”. When John Dearheart, the son of its inventor, is murdered, a piece of code is written called “GNU John Dearheart” to echo his name up and down the lines. “G” means that the message must be passed on, “N” means “not logged”, and “U” means the message should be turned around at the end of a line. (This was also a realworld tech joke: GNU is a free operating system, and its name stands, with recursive geek humour, for “GNU’s not Unix”.) The code causes Dearheart’s name to be repeated indefinitely throughout the system, because: “A man is not dead while his name is still spoken.”

What better way to remember the beloved inventor of this fictional system, then, than “GNU Terry Pratchett”?”

Source: The Guardian

This, of course, means simply adding a HEADER value for HTTP responses in your favourite Web Server.  The header name = “X-Clacks-Overhead”, value = “GNU Terry Pratchett”.

image


Home Office – Personal Development Space

It doesn’t seem to be discussed too much, but I think there’s great value in establishing a quiet, comfortable space in your home environment where you can work and focus. 

As a developer or architect your environment has a large impact on your creativity, your thinking and ability to concentrate.  Therefore, it’s worth spending some time examining under what conditions you perform the best.  In that vein, I’d like to invite you on a brief tour of my current workspace.

I work from home from time to time, and as a result have “requisitioned” a room as a home office.  As I perform large scale architectural work these days (i.e documentation and conceptual design), my work style and work space needs have changed slightly.  I’ve also needed to accommodate the occasional incursions by my two wonderful boys and occasionally my wife too.

Over the years [2009] as we’ve moved around, I’ve had evolving home office configurations – here’s a brief review of my current setup.

My Desktop

Desktop

My desk has become noticeably cleaner (basic) and clutter-free in the new house.  This is partially because the boys will tend to climb up onto the desk and “liberate” any desk ornaments.  I also rather enjoy the clear space.  The only non-standard accessory might be the Polycom small office conference phone for long teleconference meetings. 

Oh yeah, and a 31” Stormtrooper, naturally.

I’ve parted with some serious cash to obtain a mechanical keyboard and gaming mouse because I use them quite heavily, and the backlit keyboard is simply brilliant if when I work in low light – typically late at night, to not disturb the boys who sleep in the next room. 

I’ve retained two high definition speakers from my old Boomtube™ portable speaker system and coupled them to a fairly ordinary TDK stereo amplifier (which used to be in the kitchen).  The amp has a handy headphone jack so I can plug in headphones when needed.

Accessories

There’s a couple of small frames to keep me company (screened off in these photos) and really not much else of note.  Below the stern gaze of the Stormtrooper, sitting on top of a side table, is my old Sony turntable which is connected to the workstation underneath the desk.  Underneath that is my old (American) football helmet, and a leather backed two-volume copy of the complete Far Side by Gary Larson – not photographed.

The Office

Visitor CentreBookshelf

The view from the desk isn’t too shabby either – I’ve got a reasonably comfortable blue leather single seater for guests (or kids) and (temporarily) a rocking chair as well as two very tall wooden bookcases filled to the brim with collectables and odds and ends.  The top of the bookcase is adorned by a reasonably sized Lego™ city.

I also have a large whiteboard behind the study door, which is used to do basic diagramming and designing.  So that’s basically it – in days gone by I would have had half a dozen machines, a KVM and 5.1 or 7.1 surround sound.  These days I’ve gone for a less compact, larger space workspace with comfort and minimal clutter in mind.

Summary

Strangely enough, I feel like I’ve matured my workspace into something comfortable and spacious compared to some of my previous home offices.  By moving most of the “office tech” (server, NAS, networked printer) into a spare room, I’ve created a lot of clear space so that it doesn’t feel too cramped.

There’s only one computer in the room (under the desk) and one router which is obscured in a corner.  The emphasis is on the work space, and since the room needed to be kiddie-proof, most of the desk clutter has been removed.

How does your work space compare?  Do you prefer space, or do you work better in a compressed but highly organised area?  What do you have in your office which provides you with inspiration for ideas and designs?  Please comment.