Re: [Proftpd-user] <VirtualHost>, SNI and wildcard certificate
"TJ Saunders" <[email protected]>
| Newsgroups | gmane.network.proftpd.user |
|---|---|
| Message-ID | <[email protected]> |
> >I should mention that _proper_ SNI support in mod_tls is only recently > > working, in the current code in the master branch on GitHub, but not in > > earlier releases. So using that latest source code should Just Work(tm) > > properly (and if it doesn't, let me know). > > does is supplement the HOST command and can it be overridden by HOST? Per RFCS, if SNI *and* HOST are used, they have to match. Using HOST after the TLS handshake (where SNI may have been used) is not the best, since the access policies (trusted CAs, etc) can vary by virtual host, so trying to switch virtual hosts after those policies have been satisfied (by TLS handshake) would require a new TLS handshake. TJ _______________________________________________ ProFTPD Users List <[email protected]> Unsubscribe problems? http://www.proftpd.org/list-unsub.html