4 ms·
You don't understand, its not the web-server, it is the client's browser that is the issue. Until SNI came out, the handshake was made and validity of the key
by nivla 14y ago
You don't understand, its not the web-server, it is the client's browser that is the issue. Until SNI came out, the handshake was made and validity of the key determined even before the "Host: xyz.com" header was sent in. Without the host header your webserver can't determine which key among the multiple sites it hosts should be used for authentication. The only way so far to support non-modern browsers and to host multiple SSL sites on the same server is to assign one IP per site; the server can use these IP's to lookup the respective keys.
- StavrosK 14y agoI do understand, I just wasn't aware that there are still browsers that don't support SNI. That's too bad.
- sk5t 14y agoYou don't have to have SNI to host multiple unrelated SSL'd sites on one IP, given a Subject Alternate Name (SAN) cert and an httpd that accepts such a configuration.
- X-Istence 14y agoThose generally cost a lot of money...