How to implement Server Name Indication (SNI)

by

On the client side, you use SSL_set_tlsext_host_name(ssl, servername) before initiating the SSL connection.

On the server side, it’s a little more complicated:

  • Set up an additional SSL_CTX() for each different certificate;
  • Add a servername callback to each SSL_CTX() using SSL_CTX_set_tlsext_servername_callback();
  • In the callback, retrieve the client-supplied servername with SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name). Figure out the right SSL_CTX to go with that host name, then switch the SSL object to that SSL_CTX with SSL_set_SSL_CTX().

The s_client.c and s_server.c files in the apps/ directory of the OpenSSL source distribution implement this functionality, so they’re a good resource to see how it should be done.

More Related Contents:

  1. Directly Read/Write Handshake data with Memory BIO
  2. Serving multiple domains in one box with SNI
  3. How to generate RSA private key using OpenSSL?
  4. Password to key function compatible with OpenSSL commands?
  5. AES CTR 256 Encryption Mode of operation on OpenSSL
  6. Turn a simple socket into an SSL socket
  7. How to compile .c file with OpenSSL includes?
  8. boost asio ssl async_shutdown always finishes with an error?
  9. Error: “invalid use of incomplete type ‘RSA {aka struct rsa_st}” in OpenSSL 1.1.0
  10. AES (aes-cbc-128, aes-cbc-192, aes-cbc-256) encryption/decryption with openssl C
  11. How do I build OpenSSL statically linked against Windows runtime?
  12. x509 certificate verification in C
  13. How to do encryption using AES in Openssl
  14. Build OpenVPN with specific OpenSSL version
  15. C – Retrieving a child’s exit status that is larger than 8 bits
  16. How to concatenate string and int in C?
  17. How to create a typedef for function pointers
  18. C11 in GCC?
  19. Minimizing the amount of malloc() calls improves performance?
  20. Can a “container_of” macro ever be strictly-conforming?
  21. In C, what is the difference between `&function` and `function` when passed as arguments?
  22. Bind error while recreating socket
  23. Is a += b more efficient than a = a + b in C?
  24. multiple threads able to get flock at the same time
  25. How to know if a Linux system call is restartable or not?
  26. Using condition flags as GNU C inline asm outputs
  27. Conditional tests in primality by trial division
  28. Unsigned to signed conversion in C
  29. How can I clear an input buffer in C?
  30. QuickSort and Hoare Partition

Leave a Comment