SNI (Server Name Indication)

Server Name Indication (SNI) is a TLS extension in which the client sends the hostname it is trying to reach in the first handshake message (ClientHello). The server uses it to pick the right certificate before encryption begins.

Why it matters

Before SNI, each HTTPS site generally needed its own IP address, because the server had to present a certificate before it could see the HTTP Host header. SNI is what makes shared hosting, CDNs and cloud load balancers with thousands of domains on one IP practical.

When SNI is missing, the server returns a default certificate, which commonly produces a name mismatch error. That happens with very old clients, some scripts that connect by IP address, and monitoring tools that forget to set the name. The hostname is also visible in plain text on the network unless Encrypted Client Hello (ECH) is in use.

Example

Test the same IP with and without SNI:

openssl s_client -connect 203.0.113.10:443 -servername example.com </dev/null | openssl x509 -noout -subject
openssl s_client -connect 203.0.113.10:443 </dev/null | openssl x509 -noout -subject

Different subjects mean the server selects by SNI.

Common mistakes

• Testing by IP and concluding the certificate is wrong.
• Not configuring a sensible default server block.
• Assuming SNI hides which sites a user visits.

Related

• TLS handshake
• SAN certificate
• Virtual host handling via web server
• टूल: SSL checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.