Hacker News Reader

Comment by liquidise | Hacker News Reader

(author here) I would have loved to have SNI work. I wrote this article in response to having profound struggles making it work. My iPhone 7's Safari was routinely failing to connect to sites other browsers claimed were fine, when relying on SNI.

The day i swapped over to IP-based connections, the problem resolved itself immediately. If there is something i am missing i would love to know what it is.

View on HN

It must have been something else. Even Safari on iOS has supported SNI since iOS 4.0 (2010).

The only thing I've had SNI fail under (so far) had been Netscape Navigator 3.0 and at that point, does it really matter?

IE on Win XP. Or at least anything using the built in crypto stuff. I think firefox will still use it's own. Not sure about chrome.

You might be talking about HTTP 1.1 Host header which allows vhosts for plaintext HTTP servers. SNI allows this to happen with TLS (HTTPS, etc.) servers.

You might be able to get useful debugging information with tcpdump or wireshark because SNI itself is sent in the clear (prior to the TLS cryptographic key exchange). You could see if the server is doing something different from other servers, or the browser is doing something different from other browsers.

I have been using precisely Nginx to serve multiple HTTPS domains with certificates from Let's Encrypt since the first few weeks after it came out, so I am not sure why you think it's strictly necessary to assign them separate IP addresses. Generally speaking, there is nothing wrong with that, and it is indeed a somewhat cleaner solution, but it is definitely doable with SNI if one configures their web server appropriately.

Check out the IMHO best TLS SNI test website out there (https://sni.velox.ch/) and the Qualys SSL Labs server test (https://www.ssllabs.com/ssltest/). They may give you a staring point to find out what exactly went wrong with SNI. And the documentation of Nginx, of course.

Can you get to https://sni.velox.ch/ from your phone? What are the first few lines?

In particular, I'm curious if this is a misconfiguration on the server end, or a misconfiguration on the client end. Certain VPNs or malware can break SNI.

Never had any SNI issues with Safari. Could it be the mobile network provider (which tends to insert things like NATed IPv6 that can cause weirdness), or did it also fail over wifi?

older version of wget and Java also doesn't support SNI, for example used in API https callbacks, or Android apps. One trick I use it to load that site (or the most important) first in nginx, because those that doesn't support SNI will use that certificate.

Another option, if you don't need encryption, is to allow http.

Could you be having issues with ipv6?

Reply on news.ycombinator.com