Support For Name-based Virtual Servers
From the application protocol point of view, TLS belongs to a lower layer, although the TCP/IP model is too coarse to show it. This means that the TLS handshake is usually (except in the STARTTLS case) performed before the application protocol can start. The name-based virtual server feature being provided by the application layer, all co-hosted virtual servers share the same certificate because the server has to select and send a certificate immediately after the ClientHello message. This is a big problem in hosting environments because it means either sharing the same certificate among all customers or using a different IP address for each of them.
There are two known workarounds provided by X.509:
- If all virtual servers belong to the same domain, a wildcard certificate can be used. Besides the loose host name selection that might be a problem or not, there is no common agreement about how to match wildcard certificates. Different rules are applied depending on the application protocol or software used.
- Add every virtual host name in the subjectAltName extension. The major problem being that the certificate needs to be reissued whenever a new virtual server is added.
In order to provide the server name, RFC 4366 Transport Layer Security (TLS) Extensions allow clients to include a Server Name Indication extension (SNI) in the extended ClientHello message. This extension hints the server immediately which name the client wishes to connect to, so the server can select the appropriate certificate to send to the client.
Read more about this topic: Transport Layer Security
Famous quotes containing the words support and/or virtual:
“All experience teaches that, whenever there is a great national establishment, employing large numbers of officials, the public must be reconciled to support many incompetent men; for such is the favoritism and nepotism always prevailing in the purlieus of these establishments, that some incompetent persons are always admitted, to the exclusion of many of the worthy.”
—Herman Melville (1819–1891)
“Neither dead nor alive, the hostage is suspended by an incalculable outcome. It is not his destiny that awaits for him, nor his own death, but anonymous chance, which can only seem to him something absolutely arbitrary.... He is in a state of radical emergency, of virtual extermination.”
—Jean Baudrillard (b. 1929)