How to hide/delete No SNI Certificate in Nginx?

#1

I have 2 domains hi.com and hello.com using one IP 234.235.236.237

If I check domain hi.com in ssllabs.com I see 1 certificate, nice.

But, if I check domain hello.com in ssllabs.com I see 2 certificate:

Certificate #1: EC 256 bits (SHA256withRSA)
SCR: https://i.stack.imgur.com/EM7tz.png

Certificate #2: EC 256 bits (SHA256withRSA)

eE5VS
eE5VS.png1407x334 21.1 KB

If I add to Nginx, hi.com and hello.com not work.

server {
    listen 443 default_server ssl;
    listen [::]:443 default_server ssl;
    server_name _;
    return 444;
}

How to disable or delete Certificate #2 No SNI?

#2

Hi @Arturo,

If you want to use a ssl server block you need to specify a cert and a private key, you could create a self-signed certificate and use it as your default server so No SNI connections will reach this fake cert… or you can use the approach you are already using right now (with your real domain names oxxxxxx.club and kxxxxx.club) and it is use different ips for each domain.

Cheers,
sahsanu

#3

I use haproxy as “SNI-Router”, to decide which connection goes to which service. Simply define no default, then a non-SNI-connection will be dropped without presenting a certificate.

#4

Hi @sahsanu, thanks for the answer.

Oh, you see real domains =)

#5

Now my 2 domains have Certificate #2: RSA 2048 bits (SHA256withRSA) No SNI

Pr8GQsp
Pr8GQsp.png1448x614 40.5 KB

It`s normal?

#6

Hi,

If you want more people to help you… You would need to share us your real domain name since we can’t help if we know nothing about this server specific error.

Thank you

#7

Hi @stevenzhu, my main Certificate #1 letsencrypt nice work.

This is fake cert.
~# openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt -subj "/C=GB/ST=London/L=London/O=Global Security/OU=IT Department/CN=example.com"

server {
    listen 443 default_server;
    listen [::]:443 default_server;
    server_name _;
    ssl_certificate /etc/nginx/ssl/nginx.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx.key;
    return 444;
}

Is it okay to use such a certificate?

#8

As your server returns an error 444

return 444;

It doesn’t really matter if the certificate is valid or not.

The “No SNI” case it only for old Browsers who doesn’t use the SNI mecanism.

If you want to block these browsers, it’s fine.

If you prefer to allow them, you should present a valid certificate (and if possible the one of your most visited domain) :

  • if the browser wanted to visits a domain present in the certificate, it will works
  • if the browser wanted to visits another domain of your server, he will encounter a (probably by-passable error), as with many other websites.

According to https://caniuse.com/#feat=sni 97.4% of visitors have Browsers with SNI support.

#9

Normally only XP (and below), Android 4.2?( And below), iPhone (some version) has no SNI support.

So that seems to be a minor impact for me… (Since Major websites won’t allow you to use with XP now…)

Thank you

#10

If you have multiple IPs, then one IP per site would work best.
Otherwise…
If your directories were structured with all customer sites being subfolders to a common branch…
Like:
/provider/
/provider/company1.site
/provider/company2.site
(or you could do some aliasing within the vhost configs - but that would overcomplicate this example)

You could setup your vhost configs:

---
servername IP
serveralias _default_ #use appropriate default equivalent string
documentroot /provider/
sslcertificatefile /etc/letsencrypt/live/SAN/cert.pem #SAN would include all the names
---
servername provider
documentroot /provider/
sslcertificatefile /etc/letsencrypt/live/provider/cert.pem
---
servername company1.site
documentroot /provider/company1.site/
sslcertificatefile /etc/letsencrypt/live/company1.site/cert.pem
---
servername company2.site
documentroot /provider/company2.site/
sslcertificatefile /etc/letsencrypt/live/company2.site/cert.pem
---

So that:

http://IP/ or http://provider/
shows content at: /provider/

http://company1.site/ or http://provider/company1.site/ or http://IP/company1.site/
shows content at: /provider/company1.site/

http://company2.site/ or http://provider/company2.site/ or http://IP/company2.site/
shows content at: /provider/company2.site/

#11

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.