Indeed SNI in TLS does not work like that. SNI, as everything related to TLS, happens before any kind of HTTP traffic, hence the Host header is not taken into account at that step (but will be useful later on for the webserver to know which host you are connecting too). So to enable SNI … Read more
Along with the required library and Curl version, the request should use resolve to send SNI in the curl: curl -vik –resolve example.com:443:198.18.110.10 https://example.com/
On the client side, you use SSL_set_tlsext_host_name(ssl, servername) before initiating the SSL connection. On the server side, it’s a little more complicated: Set up an additional SSL_CTX() for each different certificate; Add a servername callback to each SSL_CTX() using SSL_CTX_set_tlsext_servername_callback(); In the callback, retrieve the client-supplied servername with SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name). Figure out the right SSL_CTX … Read more
The current version of Requests should be just fine with SNI. Further down the GitHub issue you can see the requirements: pyOpenSSL ndg-httpsclient pyasn1 Try installing those packages and then give it another shot. EDIT: As of Requests v2.12.1, ndg-httpsclient and pyasn1 are no longer required. The full list of required packages is now: pyOpenSSL … Read more
I can share my experience and approach to switching from one-IP-per certificate in a virtual hosting environment (multiple domains per server) to a load balanced environment with one IP for all domains. We looked at our Analytics (over 1 million unique visitors / month), which is mostly North American male users looking to buy auto … Read more