Category Archives : Technology

Top Level Category for Technology


Server Name Indication (SNI) – a journey

Today I went on an unusual journey, and it involved paying the price for configuring Microsoft’s web server (specifically, IIS 8.0 and 8.5) with scant regard for why it works the way it does.  Let me start at the beginning..

As of Internet Information Services (IIS) 8.0 (Windows Server 2012) and continuing in the latest version, 8.5 (Windows Server 2012 R2) there is now support for “Server Name Indication”, or SNI.  IIS allows you to set this value when configuring HTTPS site bindings on websites, as per below:

image

“Require Server Name Indication” or “make IIS support multiple SSL/TLS certificates” as I used to call it is a feature of IIS which allows you to bind different digital certificates to different websites within IIS using the same IP address.

Prior to IIS 8.0, you could only bind a single certificate to an individual IP address which you could only bind to one website, due to the way that handshaking worked at the time.  From Wikipedia:

Server Name Indication (SNI) is an extension to the TLS computer networking protocol[1] by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process.

This allows a server to present multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites (or any other Service over TLS) to be served off the same IP address without requiring all those sites to use the same certificate. It is the conceptual equivalent to HTTP/1.1 name-based virtual hosting, but for HTTPS.

Now there’s a caveat with SNI, and one which I did not truly appreciate until today – some older “legacy” browsers, applications and libraries do not support SNI.

No support for SNI

The following combinations do not implement SNI (from Wikipedia again):

Client side
Server side
Libraries
  • Qt client side up to 4.7
  • Mozilla NSS server side
  • Java before 1.7
  • Python 2.x (except 2.7.9), 3.0, 3.1 (ssl, urllib[2] and httplib modules)

This begs the painful question..

What happens when something which does not support SNI tries to call a website or web service which relies on SNI – such as websites hosted within IIS?

Consider what happens when a client which supports SNI makes a request of IIS 8.0 or 8.5:

image

Because the site name indicator is supplied, IIS is able to locate the correct certificate for the named site and return it as part of the TLS handshake (prior to receiving HTTPS headers).  If no named site is found, it will resort to the default certificate/HTTPS binding if there is one – note: you should have a default certificate set!

Now, let’s compare that with what would happen when SNI is not supported by the client:

image
Note: this assumes the default website has the default https/443 bound to it.

Because the initial TLS handshake does not include the server name indicator (the name of the requested site) IIS will default to returning whatever’s bound by default.  This will likely not match the certificate expected!

Some symptoms of clients not supporting SNI:

  • Certificate mismatch (requested URI doesn’t match certificate common name) – default certificate is returned
  • Intended website has no requests logged (but HTTP requests are logged – assuming a http binding is also used!)
  • Intended request is logged against the default site instead of the intended site

One potential solution

If most of your sites use the same domain, you can assign a wildcard certificate to be the default for https/443 binding.  When the non-SNI request arrives, the wildcard will match and then the subsequent HTTPS headers will result in the correct website being accessed:

image

I’m not sure if the sites would have to use the same wildcard certificate or not – this is currently being tested.

Another option

..could be to place a network load balancing (NLB) appliance in front of your webserver, if it supports HTTPS/SSL/TLS offloading.  This way, traffic coming from the NLB would actually be HTTP, not HTTPS.  This is obviously far less secure as the HTTPS traffic would terminate on the load balancer, but it does solve the problem in theory.

Conclusion

Well that was a fun find.  The moral of the story is.. take time to understand why certain settings “make things work”, or else chances are you’ll find out the hard way.  I hope this article helped someone out there.


Remembering Terry Pratchett

“Tech-savvy admirers of the late Terry Pratchett have hit upon an idea for a particularly appropriate memorial. It will be everywhere and nowhere, hiding in the code of the internet.

Pratchett’s 33rd Discworld novel, Going Postal, tells of the creation of an internet-like system of communication towers called “the clacks”. When John Dearheart, the son of its inventor, is murdered, a piece of code is written called “GNU John Dearheart” to echo his name up and down the lines. “G” means that the message must be passed on, “N” means “not logged”, and “U” means the message should be turned around at the end of a line. (This was also a realworld tech joke: GNU is a free operating system, and its name stands, with recursive geek humour, for “GNU’s not Unix”.) The code causes Dearheart’s name to be repeated indefinitely throughout the system, because: “A man is not dead while his name is still spoken.”

What better way to remember the beloved inventor of this fictional system, then, than “GNU Terry Pratchett”?”

Source: The Guardian

This, of course, means simply adding a HEADER value for HTTP responses in your favourite Web Server.  The header name = “X-Clacks-Overhead”, value = “GNU Terry Pratchett”.

image


IIS 8.5 Dynamic Compression Issue 1

Windows Server 2012 R2 comes with IIS 8.5, and in this release an issue has been found in relation to the Dynamic Compression module.  The module sets the “Vary” header which is used to specify caching properties that the browser uses to determine whether the response should be cached or not. 

In IIS 8.0 and earlier, the Dynamic Compression module was overwriting the Vary header with the value “Accept-Encoding”, and as it happens this is the correct value to ensure that dynamic content is correctly cached – but – according to IIS it should be appending this value to the existing value and not overwriting it.

As it happens, this was supposed to be fixed in IIS 8.5 but the fix appears to be broken.   In IIS 8.5 (which ships with Windows Server 2012 R2) the Vary header is being set to “*” and the “Accept-Encoding” from the Dynamic Compression module is not appended.  The result of this is that no dynamic content is being cached by the browser.

Workaround

Thankfully there is an easy workaround in IIS 8.5 for this:

1. Select an IIS site, and go to Configuration Editor.

image

2. Select system.web/caching/outputCache section, then set the omitVaryStar property to true

image

image

Setting this value results in the Vary header being returned with a value of “Accept-Encoding” and the browser then caches the dynamic content.