How to implement Server Name Indication (SNI)

c ssl openssl sni
2.8a8a_G picture 2.8a8a_G · Feb 25, 2011 · Viewed 26.2k times · Source

How to implement Server Name Indication(SNI) on OpenSSL in C or C++?

Are there any real world examples available?

Answer

caf picture caf · Feb 25, 2011

On the client side, you use SSL_set_tlsext_host_name(ssl, servername) before initiating the SSL connection.

On the server side, it's a little more complicated:

  • Set up an additional SSL_CTX() for each different certificate;
  • Add a servername callback to each SSL_CTX() using SSL_CTX_set_tlsext_servername_callback();
  • In the callback, retrieve the client-supplied servername with SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name). Figure out the right SSL_CTX to go with that host name, then switch the SSL object to that SSL_CTX with SSL_set_SSL_CTX().

The s_client.c and s_server.c files in the apps/ directory of the OpenSSL source distribution implement this functionality, so they're a good resource to see how it should be done.

Related questions

What are bag attributes and how can i generate them?

while converting some certificates from keystore to openssl/pem I noticed for the first time that there are "Bag Attributes" prepended to the certs. The look like this: Bag Attributes friendlyName: CN=PositiveSSL CA,O=Comodo CA Limited,L=Salford,…

Read More
Any good examples on programming using libssl?

I was wondering whether someone knows any good examples of using libssl as a programming library. Its kind of annoying only digging through the code of libssl trying to make sense of it.

Read More
How to load a PKCS#12 file in OpenSSL programmatically?

In an SSL Server Application based on OpenSSL, how can we load a PKCS#12 file programmatically? Also, can I load a PKCS#12 file having Certificate, Key & CAs in the same file in OpenSSL?

Read More