An Empirical Study of SNI Support in Different HTTP Clients #

2013-10-05

There’s a bit of a chicken and egg situation inherent in the way that SSL works. This can make hosting multiple SSL domains/certs on the same host problematic. Before an SSL client can make a request it must handshake with the server to set up a secure connection. Part of the handshake process is the server presenting it’s SSL cert to the client. Only after the connection is set up does the client send the actual HTTP request. And here’s the problem : when the server hosts multiple certs, it can’t know which cert to present to the client because the client only tells it in the HTTP request - in the form of the Host header.

There are some workarounds for this. You can run each SSL cert on a different IP, for example, but this usually isn’t much good in cloud environments.

SNI (Server Name Indication, RFC 6066) is an extension to SSL which aims to solve this problem. It allows the client to specify which domain it’s making a request to as the connection is being established. There have been a few instances in the past where SNI would have really simplified some piece of infrastructure I was setting up. But, I never actually implemented it as I was alway put off by concerns around the hit-and-miss support for it on the client side. So, I decided to actually sit down and test a bunch of HTTP clients and see whether they worked or not. As you’ll see from the results below, those concerns seem to be some be somewhat validated in the results below. If you’re running an API, for example, there are plenty of gaps in SNI support. Most notably Java 6 and Ruby 1.8.

The server-side test rig setup #

I set up Nginx with two proper SSL certs. Let’s call them domain1.com and domain2.com. One server block for each, like so:

server {
  listen 443;
  index index.html;
  server_name *.domain1.com;
  root /var/www/domain1.com;
  ssl on;
  ssl_certificate /usr/local/etc/nginx/ssl/domain1.crt;
  ssl_certificate_key /usr/local/etc/nginx/ssl/domain1.key;
}

server {
  listen 443;
  index index.html;
  server_name *.domain2.com;
  root /var/www/domain2.com;
  ssl on;
  ssl_certificate /usr/local/etc/nginx/ssl/domain2.crt;
  ssl_certificate_key /usr/local/etc/nginx/ssl/domain2.key;
}

I’m using Nginx 1.4.1 from brew on my laptop, nothing fancy. You can check for SNI support by running nginx -V.

  laptop:~ chrskly$ /usr/local/Cellar/nginx/1.4.1/bin/nginx -V
  nginx version: nginx/1.4.1
  built by clang 4.0 (tags/Apple/clang-421.0.60) (based on LLVM 3.1svn)
  TLS SNI support enabled
  configure arguments: --prefix=/usr/local/Cellar/nginx/1.4.1 --with-http_ssl_module --with-pcre --with-ipv6 --sbin-path=/usr/local/Cellar/nginx/1.4.1/bin/nginx --with-cc-opt=-I/usr/local/include --with-ld-opt=-L/usr/local/lib --conf-path=/usr/local/etc/nginx/nginx.conf --pid-path=/usr/local/var/run/nginx.pid --lock-path=/usr/local/var/run/nginx.lock --http-client-body-temp-path=/usr/local/var/run/nginx/client_body_temp --http-proxy-temp-path=/usr/local/var/run/nginx/proxy_temp --http-fastcgi-temp-path=/usr/local/var/run/nginx/fastcgi_temp --http-uwsgi-temp-path=/usr/local/var/run/nginx/uwsgi_temp --http-scgi-temp-path=/usr/local/var/run/nginx/scgi_temp --http-log-path=/usr/local/var/log/nginx --with-http_gzip_static_module

Expectations #

According to wikipedia the following do not work:

• wget before 1.14
• Java before v7
• Python 2.x (ssl, urllib[2], httplib)
• IE on XP + v6 and earler

The Results #

I tested multiple operating systems, mostly with vagrant. I only tested whatever was available in the relevant OS-provided package repositories. In some cases there were multiple version available, e.g. java 1.6 and 1.7. I saved the vagrant configs and some bits of puppet to make generating the test machines a bit easier. You can grab a copy of it over on github : https://github.com/chrskly/I-SNI-what-you-did-there

Conclusion #

So, as you can see, there are a lot of gaps in the results. Even in recent OS releases, support is missing in a lot of places. If you’re thinking of using SNI, you might want to think again.

Some other things to test/do:

• Perl
• Python httplib module and ssl module
• Write a wrapper script to automate all of the testing

References #

http://nginx.org/en/docs/http/configuring_https_servers.html

http://en.wikipedia.org/wiki/Server_Name_Indication