3 ms·
SNI is an optional extension and is legal to be missing. No SNI - no problem.
by GoblinSlayer 7y ago
SNI is an optional extension and is legal to be missing. No SNI - no problem.
- lxgr 7y agoYou won't be able to reach any web server that is sharing more than one hostname per IP that way. This includes all sites on a free Cloudflare plan to my knowledge.
- GoblinSlayer 7y agoCloudflare terminates ssl at the edge, no? Then it has the private key and has no need to care about the site certificate. It just sends a certificate with all hosts in alt names.
- lxgr 7y agoCloudflare has way more customers/hostnames than what would fit into a single X.509 certificate. (They actually do seem to do what you describe to support non-SNI clients, but not on their free tier.) SNI also allows decoupling TLS and TCP termination, which in turn allows for shared IP addresses and load balancers without necessarily delegating TLS termination and exposing certificates to some shared host.
- toast0 7y agoNearly all browsers support SNI, there's most likely not even a hidden config to disable it.
- GoblinSlayer 7y agoBrowser is not the only program that uses internet. For example, openssl doesn't send SNI by default.